Edit tour

Windows Analysis Report
WNBOZYUN.msi

Overview

General Information

Sample name:	WNBOZYUN.msi
Analysis ID:	1626773
MD5:	fbad39a4e69da1cc3bf48541c7905d4c
SHA1:	747b277cd5bb37e719877e45864f3beedc949f06
SHA256:	923efb46578f7f31a9734ec1d7e7e1b9edf1560fec54d7319179aa51cf3dd26a
Infos:

Detection

RedLine, SectopRAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

Yara detected SectopRAT

Connects to many ports of the same IP (likely port scanning)

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

PE file has a writeable .text section

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to detect virtual machines (SLDT)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

Is looking for software installed on the system

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64native

msiexec.exe (PID: 8008 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\WNBOZYUN.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 3668 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1228 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding CF32977746E218EEEDE7CA2544B2F355 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

ISBEW64.exe (PID: 284 cmdline: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AA76FFC7-070F-48AA-A57E-E6EA04FB65AC} MD5: 40F3A092744E46F3531A40B917CCA81E)

ISBEW64.exe (PID: 7604 cmdline: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{92500C82-953F-402F-B6F9-789DEC6E960E} MD5: 40F3A092744E46F3531A40B917CCA81E)

ISBEW64.exe (PID: 5912 cmdline: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1E9B171B-8544-422E-9E42-CEF439811C75} MD5: 40F3A092744E46F3531A40B917CCA81E)

ISBEW64.exe (PID: 1752 cmdline: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{715C38EC-9C71-4312-AEB8-36B923691B1B} MD5: 40F3A092744E46F3531A40B917CCA81E)

ISBEW64.exe (PID: 824 cmdline: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{18A2E0DE-C8B0-4F09-8999-BC6F4666FB02} MD5: 40F3A092744E46F3531A40B917CCA81E)

ISBEW64.exe (PID: 5528 cmdline: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A1B3A247-9AAE-4F1C-8301-F31840EC13D8} MD5: 40F3A092744E46F3531A40B917CCA81E)

ISBEW64.exe (PID: 2788 cmdline: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{27C98D69-B6ED-4325-8361-1D393661067B} MD5: 40F3A092744E46F3531A40B917CCA81E)

ISBEW64.exe (PID: 832 cmdline: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{740CDDF4-C0DD-4B2A-84ED-1DFE4BAB4319} MD5: 40F3A092744E46F3531A40B917CCA81E)

ISBEW64.exe (PID: 1752 cmdline: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{24B6B0B2-3219-47E3-8888-4F1C15C69403} MD5: 40F3A092744E46F3531A40B917CCA81E)

ISBEW64.exe (PID: 824 cmdline: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{56147674-C8B6-4BE4-9BB1-668D7373710C} MD5: 40F3A092744E46F3531A40B917CCA81E)

RoboTaskLite.exe (PID: 8216 cmdline: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe MD5: 6EE5F7F9F0016B5CC4F93A949A08F0DC)

RoboTaskLite.exe (PID: 8248 cmdline: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe MD5: 6EE5F7F9F0016B5CC4F93A949A08F0DC)

cmd.exe (PID: 8284 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

MSBuild.exe (PID: 8688 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

RoboTaskLite.exe (PID: 9028 cmdline: "C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe" MD5: 6EE5F7F9F0016B5CC4F93A949A08F0DC)

cmd.exe (PID: 9048 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

MSBuild.exe (PID: 9176 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\nxscuox	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nxscuox	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\nxscuox	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb50d6:$s14: keybd_event 0xbc02e:$v1_1: grabber@ 0xb5c92:$v1_2: <BrowserProfile>k__ 0xb671f:$v1_3: <SystemHardwares>k__ 0xb67de:$v1_5: <ScannedWallets>k__ 0xb686e:$v1_6: <DicrFiles>k__ 0xb684a:$v1_7: <MessageClientFiles>k__ 0xb6c14:$v1_8: <ScanBrowsers>k__BackingField 0xb6c66:$v1_8: <ScanWallets>k__BackingField 0xb6c83:$v1_8: <ScanScreen>k__BackingField 0xb6cbd:$v1_8: <ScanVPN>k__BackingField 0xa85f6:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa7f02:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
C:\Users\user\AppData\Local\Temp\oby	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\oby	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\oby	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb50d6:$s14: keybd_event 0xbc02e:$v1_1: grabber@ 0xb5c92:$v1_2: <BrowserProfile>k__ 0xb671f:$v1_3: <SystemHardwares>k__ 0xb67de:$v1_5: <ScannedWallets>k__ 0xb686e:$v1_6: <DicrFiles>k__ 0xb684a:$v1_7: <MessageClientFiles>k__ 0xb6c14:$v1_8: <ScanBrowsers>k__BackingField 0xb6c66:$v1_8: <ScanWallets>k__BackingField 0xb6c83:$v1_8: <ScanScreen>k__BackingField 0xb6cbd:$v1_8: <ScanVPN>k__BackingField 0xa85f6:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa7f02:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author
00000017.00000002.2316820013.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.2316820013.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000010.00000002.1995781637.0000000006210000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.1995781637.0000000006210000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000019.00000002.2314418981.0000000000F02000.00000002.00000001.01000000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.2314418981.0000000000F02000.00000002.00000001.01000000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: cmd.exe PID: 8284	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: cmd.exe PID: 8284	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 8688	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 8688	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 8688	JoeSecurity_SectopRAT	Yara detected SectopRAT	Joe Security
Process Memory Space: cmd.exe PID: 9048	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: cmd.exe PID: 9048	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 9176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 9176	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
25.2.MSBuild.exe.f00000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
25.2.MSBuild.exe.f00000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
25.2.MSBuild.exe.f00000.0.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb50d6:$s14: keybd_event 0xbc02e:$v1_1: grabber@ 0xb5c92:$v1_2: <BrowserProfile>k__ 0xb671f:$v1_3: <SystemHardwares>k__ 0xb67de:$v1_5: <ScannedWallets>k__ 0xb686e:$v1_6: <DicrFiles>k__ 0xb684a:$v1_7: <MessageClientFiles>k__ 0xb6c14:$v1_8: <ScanBrowsers>k__BackingField 0xb6c66:$v1_8: <ScanWallets>k__BackingField 0xb6c83:$v1_8: <ScanScreen>k__BackingField 0xb6cbd:$v1_8: <ScanVPN>k__BackingField 0xa85f6:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa7f02:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
16.2.cmd.exe.62100c8.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.cmd.exe.62100c8.6.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.2.cmd.exe.62100c8.6.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb50d6:$s14: keybd_event 0xbc02e:$v1_1: grabber@ 0xb5c92:$v1_2: <BrowserProfile>k__ 0xb671f:$v1_3: <SystemHardwares>k__ 0xb67de:$v1_5: <ScannedWallets>k__ 0xb686e:$v1_6: <DicrFiles>k__ 0xb684a:$v1_7: <MessageClientFiles>k__ 0xb6c14:$v1_8: <ScanBrowsers>k__BackingField 0xb6c66:$v1_8: <ScanWallets>k__BackingField 0xb6c83:$v1_8: <ScanScreen>k__BackingField 0xb6cbd:$v1_8: <ScanVPN>k__BackingField 0xa85f6:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa7f02:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
16.2.cmd.exe.62100c8.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.cmd.exe.62100c8.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.2.cmd.exe.62100c8.6.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb32d6:$s14: keybd_event 0xba22e:$v1_1: grabber@ 0xb3e92:$v1_2: <BrowserProfile>k__ 0xb491f:$v1_3: <SystemHardwares>k__ 0xb49de:$v1_5: <ScannedWallets>k__ 0xb4a6e:$v1_6: <DicrFiles>k__ 0xb4a4a:$v1_7: <MessageClientFiles>k__ 0xb4e14:$v1_8: <ScanBrowsers>k__BackingField 0xb4e66:$v1_8: <ScanWallets>k__BackingField 0xb4e83:$v1_8: <ScanScreen>k__BackingField 0xb4ebd:$v1_8: <ScanVPN>k__BackingField 0xa67f6:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa6102:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
23.2.cmd.exe.51000c8.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
23.2.cmd.exe.51000c8.6.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.2.cmd.exe.51000c8.6.raw.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb50d6:$s14: keybd_event 0xbc02e:$v1_1: grabber@ 0xb5c92:$v1_2: <BrowserProfile>k__ 0xb671f:$v1_3: <SystemHardwares>k__ 0xb67de:$v1_5: <ScannedWallets>k__ 0xb686e:$v1_6: <DicrFiles>k__ 0xb684a:$v1_7: <MessageClientFiles>k__ 0xb6c14:$v1_8: <ScanBrowsers>k__BackingField 0xb6c66:$v1_8: <ScanWallets>k__BackingField 0xb6c83:$v1_8: <ScanScreen>k__BackingField 0xb6cbd:$v1_8: <ScanVPN>k__BackingField 0xa85f6:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa7f02:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
23.2.cmd.exe.51000c8.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
23.2.cmd.exe.51000c8.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.2.cmd.exe.51000c8.6.unpack	MALWARE_Win_Arechclient2	Detects Arechclient2 RAT	ditekSHen	0xb32d6:$s14: keybd_event 0xba22e:$v1_1: grabber@ 0xb3e92:$v1_2: <BrowserProfile>k__ 0xb491f:$v1_3: <SystemHardwares>k__ 0xb49de:$v1_5: <ScannedWallets>k__ 0xb4a6e:$v1_6: <DicrFiles>k__ 0xb4a4a:$v1_7: <MessageClientFiles>k__ 0xb4e14:$v1_8: <ScanBrowsers>k__BackingField 0xb4e66:$v1_8: <ScanWallets>k__BackingField 0xb4e83:$v1_8: <ScanScreen>k__BackingField 0xb4ebd:$v1_8: <ScanVPN>k__BackingField 0xa67f6:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost 0xa6102:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
Click to see the 10 entries

Suricata Signatures

ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-28T21:49:15.639349+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49721	92.255.85.23	9000	TCP
2025-02-28T21:49:16.332150+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49723	92.255.85.23	9000	TCP
2025-02-28T21:49:17.001457+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49724	92.255.85.23	9000	TCP
2025-02-28T21:49:17.669279+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49725	92.255.85.23	9000	TCP
2025-02-28T21:49:18.338009+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49726	92.255.85.23	9000	TCP
2025-02-28T21:49:19.009232+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49727	92.255.85.23	9000	TCP
2025-02-28T21:49:19.682736+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49728	92.255.85.23	9000	TCP
2025-02-28T21:49:20.341325+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49729	92.255.85.23	9000	TCP
2025-02-28T21:49:21.008206+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49730	92.255.85.23	9000	TCP
2025-02-28T21:49:21.676092+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49731	92.255.85.23	9000	TCP
2025-02-28T21:49:22.354750+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49732	92.255.85.23	9000	TCP
2025-02-28T21:49:23.025397+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49733	92.255.85.23	9000	TCP
2025-02-28T21:49:23.697663+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49734	92.255.85.23	9000	TCP
2025-02-28T21:49:24.356086+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49735	92.255.85.23	9000	TCP
2025-02-28T21:49:25.024715+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49736	92.255.85.23	9000	TCP
2025-02-28T21:49:25.688136+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49737	92.255.85.23	9000	TCP
2025-02-28T21:49:26.360321+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49738	92.255.85.23	9000	TCP
2025-02-28T21:49:27.042496+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49739	92.255.85.23	9000	TCP
2025-02-28T21:49:27.700237+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49740	92.255.85.23	9000	TCP
2025-02-28T21:49:28.371689+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49741	92.255.85.23	9000	TCP
2025-02-28T21:49:29.045551+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49742	92.255.85.23	9000	TCP
2025-02-28T21:49:29.726819+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49743	92.255.85.23	9000	TCP
2025-02-28T21:49:30.392725+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49744	92.255.85.23	9000	TCP
2025-02-28T21:49:31.091530+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49745	92.255.85.23	9000	TCP
2025-02-28T21:49:31.774416+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49746	92.255.85.23	9000	TCP
2025-02-28T21:49:32.444646+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49747	92.255.85.23	9000	TCP
2025-02-28T21:49:33.107175+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49748	92.255.85.23	9000	TCP
2025-02-28T21:49:33.779553+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49749	92.255.85.23	9000	TCP
2025-02-28T21:49:34.458836+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49750	92.255.85.23	9000	TCP
2025-02-28T21:49:35.119069+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49751	92.255.85.23	9000	TCP
2025-02-28T21:49:35.780920+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49752	92.255.85.23	9000	TCP
2025-02-28T21:49:36.459307+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49753	92.255.85.23	9000	TCP
2025-02-28T21:49:37.134636+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49754	92.255.85.23	9000	TCP
2025-02-28T21:49:37.816587+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49755	92.255.85.23	9000	TCP
2025-02-28T21:49:38.482749+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49756	92.255.85.23	9000	TCP
2025-02-28T21:49:39.154421+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49757	92.255.85.23	9000	TCP
2025-02-28T21:49:39.827188+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49758	92.255.85.23	9000	TCP
2025-02-28T21:49:40.507387+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49759	92.255.85.23	9000	TCP
2025-02-28T21:49:41.183527+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49760	92.255.85.23	9000	TCP
2025-02-28T21:49:41.863507+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49761	92.255.85.23	9000	TCP
2025-02-28T21:49:42.536772+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49762	92.255.85.23	9000	TCP
2025-02-28T21:49:43.207901+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49763	92.255.85.23	9000	TCP
2025-02-28T21:49:43.902691+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49764	92.255.85.23	9000	TCP
2025-02-28T21:49:44.570838+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49765	92.255.85.23	9000	TCP
2025-02-28T21:49:45.242743+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49766	92.255.85.23	9000	TCP
2025-02-28T21:49:45.914241+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49767	92.255.85.23	9000	TCP
2025-02-28T21:49:46.605846+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49768	92.255.85.23	9000	TCP
2025-02-28T21:49:47.274157+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49769	92.255.85.23	9000	TCP
2025-02-28T21:49:47.960716+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49770	92.255.85.23	9000	TCP
2025-02-28T21:49:48.680352+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49771	92.255.85.23	9000	TCP
2025-02-28T21:49:49.367194+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49772	92.255.85.23	9000	TCP
2025-02-28T21:49:50.052855+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49773	92.255.85.23	9000	TCP
2025-02-28T21:49:50.708820+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49774	92.255.85.23	9000	TCP
2025-02-28T21:49:51.373614+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49775	92.255.85.23	9000	TCP
2025-02-28T21:49:52.038264+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49776	92.255.85.23	9000	TCP
2025-02-28T21:49:52.722678+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49777	92.255.85.23	9000	TCP
2025-02-28T21:49:53.382829+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49778	92.255.85.23	9000	TCP
2025-02-28T21:49:54.067477+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49779	92.255.85.23	9000	TCP
2025-02-28T21:49:54.729970+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49780	92.255.85.23	9000	TCP
2025-02-28T21:49:55.424910+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49781	92.255.85.23	9000	TCP
2025-02-28T21:49:56.355608+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49782	92.255.85.23	9000	TCP
2025-02-28T21:49:57.138462+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49783	92.255.85.23	9000	TCP
2025-02-28T21:49:57.808303+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49784	92.255.85.23	9000	TCP
2025-02-28T21:49:58.725564+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49785	92.255.85.23	9000	TCP
2025-02-28T21:49:59.400724+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49786	92.255.85.23	9000	TCP
2025-02-28T21:50:00.317077+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49787	92.255.85.23	9000	TCP
2025-02-28T21:50:01.009304+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49788	92.255.85.23	9000	TCP
2025-02-28T21:50:01.678384+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49789	92.255.85.23	9000	TCP
2025-02-28T21:50:02.492395+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49790	92.255.85.23	9000	TCP
2025-02-28T21:50:03.322718+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49791	92.255.85.23	9000	TCP
2025-02-28T21:50:04.079042+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49792	92.255.85.23	9000	TCP
2025-02-28T21:50:04.997835+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49793	92.255.85.23	9000	TCP
2025-02-28T21:50:05.665489+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49794	92.255.85.23	9000	TCP
2025-02-28T21:50:06.365705+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49795	92.255.85.23	9000	TCP
2025-02-28T21:50:07.282606+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49796	92.255.85.23	9000	TCP
2025-02-28T21:50:07.943582+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49797	92.255.85.23	9000	TCP
2025-02-28T21:50:09.642044+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49798	92.255.85.23	9000	TCP
2025-02-28T21:50:10.343524+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49799	92.255.85.23	9000	TCP
2025-02-28T21:50:11.106605+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49800	92.255.85.23	9000	TCP
2025-02-28T21:50:13.036881+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49801	92.255.85.23	9000	TCP
2025-02-28T21:50:14.753432+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49802	92.255.85.23	9000	TCP
2025-02-28T21:50:15.662289+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49803	92.255.85.23	9000	TCP
2025-02-28T21:50:16.373764+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49804	92.255.85.23	9000	TCP
2025-02-28T21:50:17.172794+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49805	92.255.85.23	9000	TCP
2025-02-28T21:50:17.844478+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49806	92.255.85.23	9000	TCP
2025-02-28T21:50:18.760545+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49807	92.255.85.23	9000	TCP
2025-02-28T21:50:19.661929+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49808	92.255.85.23	9000	TCP
2025-02-28T21:50:20.564060+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49810	92.255.85.23	9000	TCP
2025-02-28T21:50:21.580581+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49812	92.255.85.23	9000	TCP
2025-02-28T21:50:22.522758+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49813	92.255.85.23	9000	TCP
2025-02-28T21:50:23.428336+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49814	92.255.85.23	9000	TCP
2025-02-28T21:50:24.252184+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49815	92.255.85.23	9000	TCP
2025-02-28T21:50:25.163162+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49816	92.255.85.23	9000	TCP
2025-02-28T21:50:25.954313+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49817	92.255.85.23	9000	TCP
2025-02-28T21:50:26.637128+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49818	92.255.85.23	9000	TCP
2025-02-28T21:50:27.307581+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49819	92.255.85.23	9000	TCP
2025-02-28T21:50:28.077227+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49820	92.255.85.23	9000	TCP
2025-02-28T21:50:28.755337+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49822	92.255.85.23	9000	TCP
2025-02-28T21:50:29.432979+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49824	92.255.85.23	9000	TCP
2025-02-28T21:50:30.356199+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49825	92.255.85.23	9000	TCP
2025-02-28T21:50:31.012721+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49826	92.255.85.23	9000	TCP
2025-02-28T21:50:31.740695+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49827	92.255.85.23	9000	TCP
2025-02-28T21:50:32.417387+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49828	92.255.85.23	9000	TCP
2025-02-28T21:50:33.086988+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49830	92.255.85.23	9000	TCP
2025-02-28T21:50:33.747692+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49831	92.255.85.23	9000	TCP
2025-02-28T21:50:34.428126+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49834	92.255.85.23	9000	TCP
2025-02-28T21:50:35.776972+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49836	92.255.85.23	9000	TCP
2025-02-28T21:50:36.494250+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49838	92.255.85.23	9000	TCP
2025-02-28T21:50:39.198102+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49842	92.255.85.23	9000	TCP
2025-02-28T21:50:39.858441+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49843	92.255.85.23	9000	TCP
2025-02-28T21:50:40.540355+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49844	92.255.85.23	9000	TCP
2025-02-28T21:50:41.429136+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49847	92.255.85.23	9000	TCP
2025-02-28T21:50:42.527982+0100	2052248	1	A Network Trojan was detected	192.168.11.20	49850	92.255.85.23	9000	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-28T21:49:16.332150+0100	2803305	3	Unknown Traffic	192.168.11.20	49723	92.255.85.23	9000	TCP
2025-02-28T21:49:18.338009+0100	2803305	3	Unknown Traffic	192.168.11.20	49726	92.255.85.23	9000	TCP
2025-02-28T21:49:19.682736+0100	2803305	3	Unknown Traffic	192.168.11.20	49728	92.255.85.23	9000	TCP
2025-02-28T21:49:21.676092+0100	2803305	3	Unknown Traffic	192.168.11.20	49731	92.255.85.23	9000	TCP
2025-02-28T21:49:22.354750+0100	2803305	3	Unknown Traffic	192.168.11.20	49732	92.255.85.23	9000	TCP
2025-02-28T21:49:23.025397+0100	2803305	3	Unknown Traffic	192.168.11.20	49733	92.255.85.23	9000	TCP
2025-02-28T21:49:25.024715+0100	2803305	3	Unknown Traffic	192.168.11.20	49736	92.255.85.23	9000	TCP
2025-02-28T21:49:26.360321+0100	2803305	3	Unknown Traffic	192.168.11.20	49738	92.255.85.23	9000	TCP
2025-02-28T21:49:28.371689+0100	2803305	3	Unknown Traffic	192.168.11.20	49741	92.255.85.23	9000	TCP
2025-02-28T21:49:29.726819+0100	2803305	3	Unknown Traffic	192.168.11.20	49743	92.255.85.23	9000	TCP
2025-02-28T21:49:31.091530+0100	2803305	3	Unknown Traffic	192.168.11.20	49745	92.255.85.23	9000	TCP
2025-02-28T21:49:32.444646+0100	2803305	3	Unknown Traffic	192.168.11.20	49747	92.255.85.23	9000	TCP
2025-02-28T21:49:33.779553+0100	2803305	3	Unknown Traffic	192.168.11.20	49749	92.255.85.23	9000	TCP
2025-02-28T21:49:35.780920+0100	2803305	3	Unknown Traffic	192.168.11.20	49752	92.255.85.23	9000	TCP
2025-02-28T21:49:37.816587+0100	2803305	3	Unknown Traffic	192.168.11.20	49755	92.255.85.23	9000	TCP
2025-02-28T21:49:38.482749+0100	2803305	3	Unknown Traffic	192.168.11.20	49756	92.255.85.23	9000	TCP
2025-02-28T21:49:39.154421+0100	2803305	3	Unknown Traffic	192.168.11.20	49757	92.255.85.23	9000	TCP
2025-02-28T21:49:39.827188+0100	2803305	3	Unknown Traffic	192.168.11.20	49758	92.255.85.23	9000	TCP
2025-02-28T21:49:40.507387+0100	2803305	3	Unknown Traffic	192.168.11.20	49759	92.255.85.23	9000	TCP
2025-02-28T21:49:41.183527+0100	2803305	3	Unknown Traffic	192.168.11.20	49760	92.255.85.23	9000	TCP
2025-02-28T21:49:43.207901+0100	2803305	3	Unknown Traffic	192.168.11.20	49763	92.255.85.23	9000	TCP
2025-02-28T21:49:44.570838+0100	2803305	3	Unknown Traffic	192.168.11.20	49765	92.255.85.23	9000	TCP
2025-02-28T21:49:48.680352+0100	2803305	3	Unknown Traffic	192.168.11.20	49771	92.255.85.23	9000	TCP
2025-02-28T21:49:50.052855+0100	2803305	3	Unknown Traffic	192.168.11.20	49773	92.255.85.23	9000	TCP
2025-02-28T21:49:50.708820+0100	2803305	3	Unknown Traffic	192.168.11.20	49774	92.255.85.23	9000	TCP
2025-02-28T21:49:56.355608+0100	2803305	3	Unknown Traffic	192.168.11.20	49782	92.255.85.23	9000	TCP
2025-02-28T21:49:59.400724+0100	2803305	3	Unknown Traffic	192.168.11.20	49786	92.255.85.23	9000	TCP
2025-02-28T21:50:01.009304+0100	2803305	3	Unknown Traffic	192.168.11.20	49788	92.255.85.23	9000	TCP
2025-02-28T21:50:05.665489+0100	2803305	3	Unknown Traffic	192.168.11.20	49794	92.255.85.23	9000	TCP
2025-02-28T21:50:06.365705+0100	2803305	3	Unknown Traffic	192.168.11.20	49795	92.255.85.23	9000	TCP
2025-02-28T21:50:16.373764+0100	2803305	3	Unknown Traffic	192.168.11.20	49804	92.255.85.23	9000	TCP
2025-02-28T21:50:17.172794+0100	2803305	3	Unknown Traffic	192.168.11.20	49805	92.255.85.23	9000	TCP
2025-02-28T21:50:18.760545+0100	2803305	3	Unknown Traffic	192.168.11.20	49807	92.255.85.23	9000	TCP
2025-02-28T21:50:21.580581+0100	2803305	3	Unknown Traffic	192.168.11.20	49812	92.255.85.23	9000	TCP
2025-02-28T21:50:22.522758+0100	2803305	3	Unknown Traffic	192.168.11.20	49813	92.255.85.23	9000	TCP
2025-02-28T21:50:23.428336+0100	2803305	3	Unknown Traffic	192.168.11.20	49814	92.255.85.23	9000	TCP
2025-02-28T21:50:24.252184+0100	2803305	3	Unknown Traffic	192.168.11.20	49815	92.255.85.23	9000	TCP
2025-02-28T21:50:25.163162+0100	2803305	3	Unknown Traffic	192.168.11.20	49816	92.255.85.23	9000	TCP
2025-02-28T21:50:25.954313+0100	2803305	3	Unknown Traffic	192.168.11.20	49817	92.255.85.23	9000	TCP
2025-02-28T21:50:28.077227+0100	2803305	3	Unknown Traffic	192.168.11.20	49820	92.255.85.23	9000	TCP
2025-02-28T21:50:31.012721+0100	2803305	3	Unknown Traffic	192.168.11.20	49826	92.255.85.23	9000	TCP
2025-02-28T21:50:32.417387+0100	2803305	3	Unknown Traffic	192.168.11.20	49828	92.255.85.23	9000	TCP
2025-02-28T21:50:33.086988+0100	2803305	3	Unknown Traffic	192.168.11.20	49830	92.255.85.23	9000	TCP
2025-02-28T21:50:39.858441+0100	2803305	3	Unknown Traffic	192.168.11.20	49843	92.255.85.23	9000	TCP
2025-02-28T21:50:40.540355+0100	2803305	3	Unknown Traffic	192.168.11.20	49844	92.255.85.23	9000	TCP
2025-02-28T21:50:41.429136+0100	2803305	3	Unknown Traffic	192.168.11.20	49847	92.255.85.23	9000	TCP
2025-02-28T21:50:42.527982+0100	2803305	3	Unknown Traffic	192.168.11.20	49850	92.255.85.23	9000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\oby	Avira: detection malicious, Label: HEUR/AGEN.1307453
Source: C:\Users\user\AppData\Local\Temp\nxscuox	Avira: detection malicious, Label: HEUR/AGEN.1307453

Multi AV Scanner detection for submitted file

Source: WNBOZYUN.msi

Virustotal: Detection: 8%

Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0715BE18 CryptUnprotectData,		21_2_0715BE18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0715C3D8 CryptUnprotectData,		21_2_0715C3D8

Source:	Binary string: System.Windows.Forms.pdb source: MSBuild.exe, 00000019.00000002.2321176638.000000007125B000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: MSBuild.exe, 00000019.00000002.2321176638.000000007125B000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: MSBuild.exe, 00000019.00000002.2321176638.000000007125B000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: System.Drawing.pdb source: MSBuild.exe, 00000019.00000002.2335553294.000000007143B000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: wntdll.pdbUGP source: RoboTaskLite.exe, 0000000E.00000002.1699269189.00000000097F6000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000002.1699979016.0000000009B50000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1993896260.000000000538E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994753374.0000000005860000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2316206132.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315110494.000000000475D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb source: MSBuild.exe, 00000019.00000002.2335553294.000000007143B000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: wntdll.pdb source: RoboTaskLite.exe, 0000000E.00000002.1699269189.00000000097F6000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000002.1699979016.0000000009B50000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1993896260.000000000538E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994753374.0000000005860000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2316206132.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315110494.000000000475D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: MSBuild.exe, 00000019.00000002.2335553294.000000007143B000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\CodeBases\isdev\Src\Runtime\InstallScript\ISBEW64\x64\Release\ISBEW64.pdb source: ISBEW64.exe, 00000004.00000002.1675618110.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000004.00000000.1672941239.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000005.00000002.1676258702.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000005.00000000.1673719563.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000006.00000002.1676806540.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000006.00000000.1674488757.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000007.00000002.1677304517.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000007.00000000.1675280936.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000008.00000000.1676072102.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000008.00000002.1678032706.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000009.00000002.1697859923.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000009.00000000.1677296572.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000A.00000002.1680040069.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000A.00000000.1677919117.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000B.00000002.1681197813.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000B.00000000.1678535284.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000C.00000000.1679171611.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000C.00000002.1682063704.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000D.00000002.1682934777.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000D.00000000.1679901810.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: d:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0338F4B9h	21_2_0338F0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0338F4B9h	21_2_0338F0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 077306F4h	21_2_077300E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 07739719h	21_2_07739701

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49723 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49726 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49735 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49721 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49727 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49732 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49739 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49748 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49743 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49742 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49731 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49749 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49772 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49777 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49725 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49733 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49757 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49738 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49724 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49787 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49752 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49763 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49774 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49734 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49782 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49729 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49786 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49741 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49769 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49793 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49771 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49740 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49728 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49778 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49799 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49758 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49756 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49766 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49736 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49753 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49755 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49784 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49803 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49802 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49747 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49781 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49790 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49767 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49773 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49789 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49759 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49754 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49737 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49785 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49768 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49730 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49780 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49779 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49796 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49800 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49764 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49792 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49746 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49795 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49801 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49765 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49760 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49797 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49775 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49761 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49788 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49798 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49744 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49804 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49745 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49805 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49806 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49807 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49808 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49810 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49812 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49750 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49814 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49813 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49815 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49783 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49816 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49817 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49751 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49819 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49820 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49818 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49826 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49824 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49827 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49822 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49828 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49830 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49762 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49831 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49770 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49838 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49776 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49842 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49791 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49825 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49836 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49794 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49843 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49844 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49847 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49850 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.11.20:49834 -> 92.255.85.23:9000

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 92.255.85.23 ports 9000,1,4,5,7,8,15847

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49850

Source: global traffic

TCP traffic: 192.168.11.20:49720 -> 92.255.85.23:15847

Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000

Source: Joe Sandbox View

ASN Name: SOVTEL-ASRU SOVTEL-ASRU

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49726 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49723 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49732 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49743 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49749 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49731 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49733 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49757 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49738 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49752 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49763 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49774 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49782 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49786 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49741 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49771 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49756 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49755 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49728 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49736 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49758 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49747 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49773 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49759 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49795 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49765 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49760 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49788 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49745 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49804 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49805 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49807 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49812 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49814 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49813 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49815 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49816 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49817 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49820 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49826 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49828 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49830 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49794 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49843 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49844 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49847 -> 92.255.85.23:9000
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49850 -> 92.255.85.23:9000

Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.165.195
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.36.194
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.165.195
Source: unknown	TCP traffic detected without corresponding DNS query: 23.192.36.194
Source: unknown	TCP traffic detected without corresponding DNS query: 23.50.115.141
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.85.23

Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000
Source: global traffic	HTTP traffic detected: GET /wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC HTTP/1.1Host: 92.255.85.23:9000

Source: MSBuild.exe, 00000015.00000002.2906232717.0000000003AC4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003B3D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.00000000039B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ","type":"MediaFoundationOptIn"},{"name":"OptOut","type":"MediaFoundationOptOut"}],"version":1},"web_notification_override":{"applications":[{"applied_policy":"prompt","domain":"www.reddit.com"},{"applied_policy":"prompt","domain":"www.telegraphindia.com"},{"applied_policy":"prompt","domain":"timesofindia.indiatimes.com"},{"applied_policy":"prompt","domain":"pushengage.com"},{"applied_policy":"prompt","domain":"www.timesnownews.com"},{"applied_policy":"prompt","domain":"www.couponrani.com"},{"applied_policy":"prompt","domain":"www.wholesomeyum.com"},{"applied_policy":"prompt","domain":"www.asklaila.com"},{"applied_policy":"prompt","domain":"www.sammobile.com"},{"applied_policy":"prompt","domain":"www.ecuavisa.com"},{"applied_policy":"prompt","domain":"uz.sputniknews.ru"},{"applied_policy":"prompt","domain":"www.ndtv.com"},{"applied_policy":"prompt","domain":"www.elimparcial.com"},{"applied_policy":"prompt","domain":"www.povarenok.ru"},{"applied_policy":"prompt","domain":"www.estadao.com.br"},{"applied_policy":"prompt","domain":"olxpakistan.os.tc"},{"applied_policy":"prompt","domain":"televisa.com"},{"applied_policy":"prompt","domain":"uol.com.br"},{"applied_policy":"prompt","domain":"www.axisbank.com"},{"applied_policy":"prompt","domain":"mutualfund.adityabirlacapital.com"},{"applied_policy":"prompt","domain":"www.facebook.com"},{"applied_policy":"prompt","domain":"www.instagram.com"},{"applied_policy":"prompt","domain":"www.messenger.com"}],"policies":[{"name":"prompt","reason":"","type":"","value":""}],"version":1}},"fre":{"autoimport_spartan_visible_item_completed":true,"oem_bookmarks_set":true,"should_user_see_fre_banner":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default"},"hardware_acceleration_mode_previous":true,"is_dsp_recommended":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"Default":{"migration_attempt":0,"migration_version":4},"last_edgeuwp_pin_migration_on_edge_version":"94.0.992.31","last_edgeuwp_pin_migration_on_os_version":"10 Version 20H2 (Build 19042.1165)","last_edgeuwp_pin_migration_success":false},"network_primary_browser":{"browser_name_enum":1,"last_computed_time":"13276780388565220","network_usage":{"browser_with_highest_network_usage":1,"browsers_usage":{"1":100.0},"ie":0}},"network_time":{"network_time_mapping":{"local":1.691263997088662e+12,"network":1.691260396e+12,"ticks":126914944.0,"uncertainty":1220870.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAb7qWBj3YRSZSg2yN3JOzDEAAAAAoAAABFAGQAZwBlAAAAEGYAAAABAAAgAAAAcjDYF/dB+Ehkggnbhv5UEmuk4qMrV300v/DxeYPr2kcAAAAADoAAAAACAAAgAAAA4Fc7bPPxg5D3HUrv9FeO3M8NoHE1hRCd1+t1vMyMeGIwAAAA60sl/pIpVYUn/pFhWuHqOweLytcqg8K9+apLINEdcjv+lt8eT+qH7hjP4LZPc65wQAAAABgU4kp6fr9r5p49VZoKZkZbDP1PXsAR/6XYDO+DikEUGEeRYwj0k5LNwmmr0tZ5hKexU3XBg6oVvPcKgnBt6go="},"policy":{"last_statistics_update":"13335737596278882"},"profile":{"info_cache":{"Default":{"active_time":1691263997.009407,"avatar_icon":"chrome://theme/IDR_PROFILE_AVATAR_20",
Source: MSBuild.exe, 00000015.00000002.2906232717.0000000003AC4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003B3D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.00000000039B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)

Source: MSBuild.exe, 00000015.00000002.2906232717.00000000034E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.85.23:9000
Source: MSBuild.exe, 00000015.00000002.2906232717.00000000034E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://92.255.85.23:9000/wbinjget?q=DCD19E1DA2479B3D22ABB9ECA2F479AC
Source: MSBuild.exe, 00000019.00000002.2321176638.0000000070B41000.00000020.00000001.01000000.00000012.sdmp	String found in binary or memory: http://beta.visualstudio.net/net/sdk/feedback.asp
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: RoboTaskLite.exe, 0000000E.00000003.1686026369.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: RoboTaskLite.exe, 0000000E.00000003.1686026369.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: RoboTaskLite.exe, 0000000E.00000003.1686026369.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: RoboTaskLite.exe, 0000000E.00000003.1686026369.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: RoboTaskLite.exe, 0000000E.00000003.1686026369.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: RoboTaskLite.exe, 0000000E.00000003.1686026369.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: RoboTaskLite.exe, 0000000E.00000003.1686026369.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: RoboTaskLite.exe, 0000000E.00000003.1686026369.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://ocsp.digicert.com0C
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://ocsp.digicert.com0O
Source: RoboTaskLite.exe, 0000000E.00000003.1686026369.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://s2.symcb.com0
Source: MSBuild.exe, 00000015.00000002.2906232717.00000000034E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: MSBuild.exe, 00000015.00000002.2906232717.00000000034E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://sv.symcd.com0&
Source: RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://www.digicert.com/CPS0
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: WNBOZYUN.msi	String found in binary or memory: http://www.flexerasoftware.com0
Source: RoboTaskLite.exe, 0000000E.00000000.1681762171.00000000005C0000.00000002.00000001.01000000.00000004.sdmp, RoboTaskLite.exe, 0000000E.00000003.1686026369.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://www.geocities.com/SiliconValley/Network/2114/zipbeta.html
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.0000000009669000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.00000000056E2000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: RoboTaskLite.exe, 0000000E.00000000.1681762171.00000000005C0000.00000002.00000001.01000000.00000004.sdmp, RoboTaskLite.exe, 0000000E.00000003.1686026369.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://www.robotask.com/
Source: RoboTaskLite.exe, 0000000E.00000000.1681198210.0000000000401000.00000020.00000001.01000000.00000004.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://www.robotask.com/?ref=rtliteopenX5OP8O
Source: RoboTaskLite.exe, 0000000E.00000000.1681198210.0000000000401000.00000020.00000001.01000000.00000004.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://www.robotask.com/bugreport/
Source: RoboTaskLite.exe, 0000000E.00000000.1681198210.0000000000401000.00000020.00000001.01000000.00000004.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://www.robotask.com/support/?ref=rtliteopen
Source: RoboTaskLite.exe, 0000000E.00000000.1681198210.0000000000401000.00000020.00000001.01000000.00000004.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://www.robotask.com/upgradefromlite/open
Source: RoboTaskLite.exe, 0000000E.00000000.1681198210.0000000000401000.00000020.00000001.01000000.00000004.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: http://www.robotask.com/upgradefromlite/openU
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://www.symauth.com/cps0(
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: http://www.symauth.com/rpa00
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: RoboTaskLite.exe, 0000000E.00000002.1700754233.0000000050051000.00000020.00000001.01000000.00000006.sdmp, rtl280.bpl.14.dr	String found in binary or memory: https://%s:%u/d.phpP
Source: MSBuild.exe, 00000015.00000002.2916592545.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000015.00000002.2916592545.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: https://d.symcb.com/cps0%
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: https://d.symcb.com/rpa0
Source: RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: MSBuild.exe, 00000015.00000002.2916592545.0000000004A28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.00000000046BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MSBuild.exe, 00000015.00000002.2906232717.00000000039B4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004CA9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.000000000392C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004A6A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004BBF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D49000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D67000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003A3C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004603000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004A3D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.000000000490A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003671000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004C80000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004B2B000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.00000000036FF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSBuild.exe, 00000015.00000002.2906232717.0000000003927000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D29000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.000000000375D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.000000000467E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.00000000039AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.000000000366C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003A37000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.00000000046BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab0
Source: MSBuild.exe, 00000015.00000002.2916592545.0000000004A28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.00000000046BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000015.00000002.2916592545.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: MSBuild.exe, 00000019.00000002.2318125914.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/UPxYyFp8
Source: MSBuild.exe, 00000019.00000002.2318125914.0000000003051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/UPxYyFp8PO
Source: RoboTaskLite.exe, 0000000E.00000000.1681198210.0000000000401000.00000020.00000001.01000000.00000004.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: https://robotask.com/help/
Source: RoboTaskLite.exe, 0000000E.00000000.1681198210.0000000000401000.00000020.00000001.01000000.00000004.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: https://robotask.com/openhelp/?id=%d.openSV
Source: RoboTaskLite.exe, 0000000E.00000003.1686026369.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, WNBOZYUN.msi, RoboTaskLite.exe.14.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: MSBuild.exe, 00000015.00000002.2906232717.0000000003927000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004CA9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D29000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004A6A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004BBF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.000000000375D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D49000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D67000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.000000000467E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004603000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004A3D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.000000000490A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.00000000039AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004C80000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.000000000366C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004B2B000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003A37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: MSBuild.exe, 00000015.00000002.2906232717.0000000003927000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004CA9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D29000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004A6A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004BBF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.000000000375D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D49000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D67000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.000000000467E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004603000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004A3D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.000000000490A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.00000000039AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004C80000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.000000000366C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004B2B000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003A37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RoboTaskLite.exe, 0000000E.00000002.1698257667.00000000096BF000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1687402201.0000000009F0E000.00000004.00000001.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000003.1691824777.0000000009F0A000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994374695.000000000572A000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp, WNBOZYUN.msi	String found in binary or memory: https://www.digicert.com/CPS0
Source: MSBuild.exe, 00000015.00000002.2916592545.0000000004CA9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004A6A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004BBF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004A3D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004C80000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004B2B000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000015.00000002.2916592545.0000000004CA9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004A6A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004BBF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004AFE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004A3D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D69000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003B23000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004C80000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004B2B000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004BEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: MSBuild.exe, 00000015.00000002.2906232717.0000000003927000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.00000000039B4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.000000000392C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.00000000036FA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D29000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.000000000375D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D49000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004D67000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.000000000467E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003A3C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004603000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.000000000490A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003671000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.00000000039AF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.000000000366C000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.00000000036FF000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003A37000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2906232717.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.0000000004A28000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000015.00000002.2916592545.00000000046BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe

Code function: 14_2_50CB8570 @Vcl@Consts@_SCannotOpenClipboard,@Vcl@Consts@_SMCIWaveAudio,@Vcl@Consts@_SMCIUnknownError,@Vcl@Consts@_SBoldItalicFont,@Vcl@Consts@_SBoldFont,@Vcl@Consts@_SItalicFont,@Vcl@Consts@_SExecute,@Vcl@Consts@_SStart,@Vcl@Consts@_SStop,@Vcl@Consts@_SPause,@Vcl@Consts@_SContinue,@Vcl@Consts@_SServiceInstallOK,@Vcl@Consts@_SServiceInstallFailed,@Vcl@Consts@_SServiceUninstallOK,@Vcl@Consts@_SServiceUninstallFailed,@Vcl@Consts@_SDockedCtlNeedsName,@Vcl@Consts@_SDockZoneVersionConflict,@Vcl@Consts@_SAllCommands,@Vcl@Consts@_SDuplicateItem,@Vcl@Consts@_STextNotFound,@Vcl@Consts@_SBrowserExecError,@Vcl@Consts@_SPromptArrayEmpty,@Vcl@Consts@_SUsername,@Vcl@Consts@_SPassword,@Vcl@Consts@_SDomain,@Vcl@Consts@_SLogin,@Vcl@Consts@_SKeyNotFound,@Vcl@Consts@_SNoColumnMoving,@Vcl@Consts@_SNoEqualsInKey,@Vcl@Consts@_SSendError,@Vcl@Consts@_SAssignSubItemError,@Vcl@Consts@_SMoreButtons,@Vcl@Consts@_SErrorDownloadingURL,@Vcl@Consts@_SUrlMonDllMissing,@Vcl@Consts@_SAllActions,@Vcl@Consts@_SNoCategory,@Vcl@Consts@_SErrorLoadingFile,@Vcl@Consts@_SResetUsageData,@Vcl@Consts@_SFileRunDialogTitle,@Vcl@Consts@_SNoName,@Vcl@Consts@_SErrorActionManagerNotAssigned,

14_2_50CB8570

Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe

Code function: 14_2_50CC7D80 @Vcl@Graphics@TMetafile@LoadFromClipboardFormat$qqrusuip10HPALETTE__,GetClipboardData,@Vcl@Consts@_SUnknownClipboardFormat,@Vcl@Graphics@TMetafile@NewImage$qqrv,CopyEnhMetaFileW,GetEnhMetaFileHeader,

14_2_50CC7D80

System Summary

Malicious sample detected (through community Yara rule)

Source: 25.2.MSBuild.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 16.2.cmd.exe.62100c8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 16.2.cmd.exe.62100c8.6.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 23.2.cmd.exe.51000c8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: 23.2.cmd.exe.51000c8.6.unpack, type: UNPACKEDPE	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\nxscuox, type: DROPPED	Matched rule: Detects Arechclient2 RAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\oby, type: DROPPED	Matched rule: Detects Arechclient2 RAT Author: ditekSHen

PE file has a writeable .text section

Source: ISRT.dll.2.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process Stats: CPU usage > 6%

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Code function: 4_2_00007FF6EF191AD0	4_2_00007FF6EF191AD0
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Code function: 4_2_00007FF6EF19CC64	4_2_00007FF6EF19CC64
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Code function: 4_2_00007FF6EF19FCE4	4_2_00007FF6EF19FCE4
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Code function: 4_2_00007FF6EF19F11C	4_2_00007FF6EF19F11C
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Code function: 4_2_00007FF6EF1A42FC	4_2_00007FF6EF1A42FC
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Code function: 4_2_00007FF6EF19D308	4_2_00007FF6EF19D308
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Code function: 4_2_00007FF6EF194230	4_2_00007FF6EF194230
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Code function: 4_2_00007FF6EF194E10	4_2_00007FF6EF194E10
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CC4100	14_2_50CC4100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0338AB50	21_2_0338AB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_03389200	21_2_03389200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0338188E	21_2_0338188E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_03384B34	21_2_03384B34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0338AB40	21_2_0338AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0338CA73	21_2_0338CA73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_03386AB4	21_2_03386AB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_03386AD8	21_2_03386AD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0338CAC0	21_2_0338CAC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_033891F1	21_2_033891F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0338506B	21_2_0338506B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_033850B8	21_2_033850B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0687E408	21_2_0687E408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_068726C0	21_2_068726C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_068726D0	21_2_068726D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06876608	21_2_06876608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06877E30	21_2_06877E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06876393	21_2_06876393
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0687D7AD	21_2_0687D7AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_068737EB	21_2_068737EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_068737F8	21_2_068737F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06873F0F	21_2_06873F0F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06876B10	21_2_06876B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06873F20	21_2_06873F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06876348	21_2_06876348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06876358	21_2_06876358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06870C00	21_2_06870C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06879030	21_2_06879030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06879040	21_2_06879040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0687A1B3	21_2_0687A1B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0687A1C0	21_2_0687A1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06874DCF	21_2_06874DCF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06874DE0	21_2_06874DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06870508	21_2_06870508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF6A60	21_2_06FF6A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF2250	21_2_06FF2250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FFAE50	21_2_06FFAE50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF3BF8	21_2_06FF3BF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FFC3D8	21_2_06FFC3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FFB728	21_2_06FFB728
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF98F0	21_2_06FF98F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF18B8	21_2_06FF18B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF4C88	21_2_06FF4C88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FFA928	21_2_06FFA928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FFD108	21_2_06FFD108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF5A90	21_2_06FF5A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF2E90	21_2_06FF2E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF2E7F	21_2_06FF2E7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF5A73	21_2_06FF5A73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FFAE36	21_2_06FFAE36
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF47B0	21_2_06FF47B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF47A0	21_2_06FF47A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FFB719	21_2_06FFB719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF7702	21_2_06FF7702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FFD0FB	21_2_06FFD0FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF98E0	21_2_06FF98E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF18A8	21_2_06FF18A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF6C90	21_2_06FF6C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF6C82	21_2_06FF6C82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FF4C79	21_2_06FF4C79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06FFA918	21_2_06FFA918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0715CF08	21_2_0715CF08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_07152FD0	21_2_07152FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_07157FEB	21_2_07157FEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0715C6F0	21_2_0715C6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0715054E	21_2_0715054E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_071521EF	21_2_071521EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_07150040	21_2_07150040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_071514B8	21_2_071514B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0715F0D0	21_2_0715F0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0715DF78	21_2_0715DF78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0715DF68	21_2_0715DF68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_07153818	21_2_07153818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_07150006	21_2_07150006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0715F0C0	21_2_0715F0C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_07738768	21_2_07738768
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_07731FF6	21_2_07731FF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0773C780	21_2_0773C780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_07736B18	21_2_07736B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_07739A78	21_2_07739A78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_07737138	21_2_07737138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0773C772	21_2_0773C772
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_07736B09	21_2_07736B09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_07739A6A	21_2_07739A6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0773A930	21_2_0773A930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_07737128	21_2_07737128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0773B1C8	21_2_0773B1C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_0773B1B8	21_2_0773B1B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 21_2_06870C10	21_2_06870C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 25_2_0181188E	25_2_0181188E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 25_2_018150B1	25_2_018150B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 25_2_018150B8	25_2_018150B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 25_2_01818013	25_2_01818013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 25_2_0181506B	25_2_0181506B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 25_2_01814B34	25_2_01814B34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 25_2_01816AB4	25_2_01816AB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 25_2_01816AD8	25_2_01816AD8

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\MSIEBB5.tmp B8FA7AA425E4084EA3721780A13D11E08B8D53D1C5414B73F22FAECA1BFD314F
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\MSIF1FF.tmp 87517950F76654DD6F807E889CA48A7DC4FA8E99A206FE19299B1359A7205430
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\nxscuox 96BA74CC27B44547D23FE1FA550FC59B4F340DBBCA8472D9B4698576751BB189

Source: MSIF1FF.tmp.0.dr

Static PE information: Resource name: PUBLICKEY type: b.out overlay separate pure segmented executable V2.3 186 286 286 386 Large Text Large Data Huge Objects Enabled

Source: RoboTaskLite.exe.14.dr	Static PE information: Number of sections : 11 > 10
Source: RoboTaskLite.exe.2.dr	Static PE information: Number of sections : 11 > 10

Source: WNBOZYUN.msi	Binary or memory string: OriginalFilename_IsIcoRes.exe< vs WNBOZYUN.msi
Source: WNBOZYUN.msi	Binary or memory string: OriginalFilenameSFHelper.dll vs WNBOZYUN.msi
Source: WNBOZYUN.msi	Binary or memory string: OriginalFilenameSetAllUsers.dll< vs WNBOZYUN.msi
Source: WNBOZYUN.msi	Binary or memory string: OriginalFilename vs WNBOZYUN.msi
Source: WNBOZYUN.msi	Binary or memory string: OriginalFilenameRoboTaskLite.exe2 vs WNBOZYUN.msi

Source: 25.2.MSBuild.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 16.2.cmd.exe.62100c8.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 16.2.cmd.exe.62100c8.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 23.2.cmd.exe.51000c8.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: 23.2.cmd.exe.51000c8.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: C:\Users\user\AppData\Local\Temp\nxscuox, type: DROPPED	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
Source: C:\Users\user\AppData\Local\Temp\oby, type: DROPPED	Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT

Source: ISRT.dll.2.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: ISRT.dll.2.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: 16.2.cmd.exe.62100c8.6.raw.unpack, -Module-.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 23.2.cmd.exe.51000c8.6.raw.unpack, -Module-.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winMSI@37/48@0/1

Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe

Code function: 14_2_50CC30FC GetLastError,FormatMessageW,@System@@UStrFromWArray$qqrr20System@UnicodeStringpbi,@System@Classes@EOutOfResources@,@System@Sysutils@Exception@$bctr$qqrx20System@UnicodeString,@System@@RaiseExcept$qqrv,@System@@UStrClr$qqrpv,

14_2_50CC30FC

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe

Code function: 4_2_00007FF6EF193140 CoCreateInstance,

4_2_00007FF6EF193140

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe

Code function: 4_2_00007FF6EF195870 LoadLibraryExW,LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

4_2_00007FF6EF195870

Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe

File created: C:\Users\user\AppData\Roaming\ServiceValid_testv2

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8292:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9060:304:WilStaging_02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\7f66e01a92e141d4a55aa3c62fd91510

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSIEBB5.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\IsConfig.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: WNBOZYUN.msi

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\WNBOZYUN.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CF32977746E218EEEDE7CA2544B2F355 C
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AA76FFC7-070F-48AA-A57E-E6EA04FB65AC}
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{92500C82-953F-402F-B6F9-789DEC6E960E}
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1E9B171B-8544-422E-9E42-CEF439811C75}
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{715C38EC-9C71-4312-AEB8-36B923691B1B}
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{18A2E0DE-C8B0-4F09-8999-BC6F4666FB02}
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A1B3A247-9AAE-4F1C-8301-F31840EC13D8}
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{27C98D69-B6ED-4325-8361-1D393661067B}
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{740CDDF4-C0DD-4B2A-84ED-1DFE4BAB4319}
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Process created: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe "C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe"
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CF32977746E218EEEDE7CA2544B2F355 C	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AA76FFC7-070F-48AA-A57E-E6EA04FB65AC}	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{92500C82-953F-402F-B6F9-789DEC6E960E}	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1E9B171B-8544-422E-9E42-CEF439811C75}	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{715C38EC-9C71-4312-AEB8-36B923691B1B}	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{18A2E0DE-C8B0-4F09-8999-BC6F4666FB02}	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A1B3A247-9AAE-4F1C-8301-F31840EC13D8}	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{27C98D69-B6ED-4325-8361-1D393661067B}	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{740CDDF4-C0DD-4B2A-84ED-1DFE4BAB4319}	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{715C38EC-9C71-4312-AEB8-36B923691B1B}	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{18A2E0DE-C8B0-4F09-8999-BC6F4666FB02}	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Process created: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: oledlg.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: pla.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: shdocvw.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: isrukqkpdcqxgy.16.dr

LNK file: ..\..\Roaming\ServiceValid_testv2\RoboTaskLite.exe

Source: C:\Windows\SysWOW64\msiexec.exe

File written: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\IsConfig.ini

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

File opened: C:\Windows\SysWOW64\RICHED32.DLL

Jump to behavior

Source: WNBOZYUN.msi

Static file information: File size 24659924 > 1048576

Source:	Binary string: System.Windows.Forms.pdb source: MSBuild.exe, 00000019.00000002.2321176638.000000007125B000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: MSBuild.exe, 00000019.00000002.2321176638.000000007125B000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: MSBuild.exe, 00000019.00000002.2321176638.000000007125B000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: System.Drawing.pdb source: MSBuild.exe, 00000019.00000002.2335553294.000000007143B000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: wntdll.pdbUGP source: RoboTaskLite.exe, 0000000E.00000002.1699269189.00000000097F6000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000002.1699979016.0000000009B50000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1993896260.000000000538E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994753374.0000000005860000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2316206132.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315110494.000000000475D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdb source: MSBuild.exe, 00000019.00000002.2335553294.000000007143B000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: wntdll.pdb source: RoboTaskLite.exe, 0000000E.00000002.1699269189.00000000097F6000.00000004.00000020.00020000.00000000.sdmp, RoboTaskLite.exe, 0000000E.00000002.1699979016.0000000009B50000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1993896260.000000000538E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.1994753374.0000000005860000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2316206132.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000017.00000002.2315110494.000000000475D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: MSBuild.exe, 00000019.00000002.2335553294.000000007143B000.00000020.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\CodeBases\isdev\Src\Runtime\InstallScript\ISBEW64\x64\Release\ISBEW64.pdb source: ISBEW64.exe, 00000004.00000002.1675618110.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000004.00000000.1672941239.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000005.00000002.1676258702.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000005.00000000.1673719563.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000006.00000002.1676806540.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000006.00000000.1674488757.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000007.00000002.1677304517.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000007.00000000.1675280936.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000008.00000000.1676072102.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000008.00000002.1678032706.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000009.00000002.1697859923.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 00000009.00000000.1677296572.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000A.00000002.1680040069.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000A.00000000.1677919117.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000B.00000002.1681197813.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000B.00000000.1678535284.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000C.00000000.1679171611.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000C.00000002.1682063704.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000D.00000002.1682934777.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp, ISBEW64.exe, 0000000D.00000000.1679901810.00007FF6EF1A7000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe

Code function: 4_2_00007FF6EF196930 SysFreeString,SysAllocString,SysFreeString,SysAllocString,SysFreeString,SysAllocString,SysFreeString,SysAllocString,LoadLibraryW,GetProcAddress,FreeLibrary,FreeLibrary,

4_2_00007FF6EF196930

Source: initial sample

Static PE information: section where entry point is pointing to: .rsrc

Source: vcl280.bpl.14.dr	Static PE information: real checksum: 0x405dec should be: 0x403876
Source: vcl280.bpl.2.dr	Static PE information: real checksum: 0x405dec should be: 0x403876
Source: MSIF1FF.tmp.0.dr	Static PE information: real checksum: 0x0 should be: 0x28b162
Source: nxscuox.23.dr	Static PE information: real checksum: 0x0 should be: 0xc48fd
Source: oby.16.dr	Static PE information: real checksum: 0x0 should be: 0xc48fd
Source: _isres_0x0409.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0x1c5ec2

Source: MSIF1FF.tmp.0.dr	Static PE information: section name: .orpc
Source: RoboTaskLite.exe.2.dr	Static PE information: section name: .didata
Source: rtl280.bpl.2.dr	Static PE information: section name: .didata
Source: vcl280.bpl.2.dr	Static PE information: section name: .didata
Source: RoboTaskLite.exe.14.dr	Static PE information: section name: .didata
Source: rtl280.bpl.14.dr	Static PE information: section name: .didata
Source: vcl280.bpl.14.dr	Static PE information: section name: .didata

Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CCE008 push ecx; mov dword ptr [esp], eax	14_2_50CCE009
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB89D8 push eax; retn 00FEh	14_2_50CB89EC
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB81D8 push eax; retn 00FFh	14_2_50CB81EC
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB81E8 push eax; retn 00FFh	14_2_50CB81EC
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB89E8 push eax; retn 00FEh	14_2_50CB89EC
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB89E0 push eax; retn 00FEh	14_2_50CB89EC
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB81E0 push eax; retn 00FFh	14_2_50CB81EC
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB81F0 push eax; ret	14_2_50CB81F4
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB89F0 push eax; ret	14_2_50CB89F4
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8248 push eax; iretd	14_2_50CB8254
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8A48 push eax; iretd	14_2_50CB8A54
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8240 push eax; iretd	14_2_50CB8254
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8A40 push eax; iretd	14_2_50CB8A54
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8250 push eax; iretd	14_2_50CB8254
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8A50 push eax; iretd	14_2_50CB8A54
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8218 push eax; retf 00FFh	14_2_50CB822C
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8A18 push eax; retf 00FEh	14_2_50CB8A2C
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8A28 push eax; retf 00FEh	14_2_50CB8A2C
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8228 push eax; retf 00FFh	14_2_50CB822C
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8A20 push eax; retf 00FEh	14_2_50CB8A2C
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8220 push eax; retf 00FFh	14_2_50CB822C
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8A38 push eax; iretd	14_2_50CB8A54
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8238 push eax; iretd	14_2_50CB8254
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8A30 push eax; retf	14_2_50CB8A34
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB8230 push eax; retf	14_2_50CB8234
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CC2C68 push ecx; mov dword ptr [esp], ecx	14_2_50CC2C6C
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CCD5EC push ecx; mov dword ptr [esp], ecx	14_2_50CCD5EF
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CC25A8 push ecx; mov dword ptr [esp], edx	14_2_50CC25AA
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CC66E8 push ecx; mov dword ptr [esp], edx	14_2_50CC66EA
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CC26BC push ecx; mov dword ptr [esp], edx	14_2_50CC26BE
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Code function: 14_2_50CB9EBC push 4050CB9Eh; retf 50F3h	14_2_50CB9ECE

Source: ISRT.dll.2.dr	Static PE information: section name: .text entropy: 7.9838191086194135
Source: oby.16.dr	Static PE information: section name: .text entropy: 6.942798527099518
Source: nxscuox.23.dr	Static PE information: section name: .text entropy: 6.942798527099518

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\oby	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	File created: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\rtl280.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	File created: C:\Users\user\AppData\Roaming\ServiceValid_testv2\rtl280.bpl	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\nxscuox	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	File created: C:\Users\user\AppData\Roaming\ServiceValid_testv2\vcl280.bpl	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\_isres_0x0409.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIF1FF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIEBB5.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\vcl280.bpl	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISRT.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\rtl280.bpl	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\vcl280.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	File created: C:\Users\user\AppData\Roaming\ServiceValid_testv2\rtl280.bpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	File created: C:\Users\user\AppData\Roaming\ServiceValid_testv2\vcl280.bpl	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\oby	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\nxscuox	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\OBY
Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\NXSCUOX

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 9000
Source: unknown	Network traffic detected: HTTP traffic on port 9000 -> 49850

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe

Code function: 4_2_00007FF6EF19CC64 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_00007FF6EF19CC64

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	API/Special instruction interceptor: Address: 6BF07C44
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	API/Special instruction interceptor: Address: 6BF07C44
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	API/Special instruction interceptor: Address: 6BF07945
Source: C:\Windows\SysWOW64\cmd.exe	API/Special instruction interceptor: Address: 6BF03B54
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	API/Special instruction interceptor: Address: 6A997C44
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	API/Special instruction interceptor: Address: 6A997945
Source: C:\Windows\SysWOW64\cmd.exe	API/Special instruction interceptor: Address: 6A993B54

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 32E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 34E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 32E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1810000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 3050000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 5050000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe

Code function: 14_2_50CB9060 sldt word ptr [eax]

14_2_50CB9060

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Window / User API: threadDelayed 9930

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\oby	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nxscuox	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\_isres_0x0409.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIF1FF.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIEBB5.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISRT.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_4-8621
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_4-8742

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Registry key enumerated: More than 210 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8824	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8824	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8692	Thread sleep time: -44095s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8824	Thread sleep time: -59890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8692	Thread sleep time: -37789s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8824	Thread sleep time: -59781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8692	Thread sleep time: -48654s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8824	Thread sleep time: -59671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8692	Thread sleep time: -39247s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8692	Thread sleep time: -33755s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8692	Thread sleep time: -48240s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8692	Thread sleep time: -38142s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8692	Thread sleep time: -59990s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8692	Thread sleep time: -51428s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2744	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 44095	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 37789	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 48654	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 39247	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 33755	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 48240	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 38142	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 59990	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 51428	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: cmd.exe, 00000017.00000002.2315680145.0000000004AF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: MSBuild.exe, 00000015.00000002.2901864358.0000000001571000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RoboTaskLite.exe, 0000000E.00000002.1700754233.0000000050051000.00000020.00000001.01000000.00000006.sdmp	Binary or memory string: VirtualMachine

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe

API call chain: ExitProcess graph end node

graph_4-8622

Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 21_2_06FF65E8 LdrInitializeThunk,

21_2_06FF65E8

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe

Code function: 4_2_00007FF6EF19D098 IsDebuggerPresent,

4_2_00007FF6EF19D098

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe

Code function: 4_2_00007FF6EF1A3008 EncodePointer,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

4_2_00007FF6EF1A3008

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe

4_2_00007FF6EF196930

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe

Code function: 4_2_00007FF6EF19CAE4 GetProcessHeap,

4_2_00007FF6EF19CAE4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Code function: 4_2_00007FF6EF19DCD4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_00007FF6EF19DCD4
Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe	Code function: 4_2_00007FF6EF1A07D8 SetUnhandledExceptionFilter,		4_2_00007FF6EF1A07D8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	NtProtectVirtualMemory: Direct from: 0x6BE54096	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	NtQuerySystemInformation: Direct from: 0x50CB71C0
Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe	NtProtectVirtualMemory: Direct from: 0x778D7A4E	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	NtProtectVirtualMemory: Direct from: 0x6BF0F932

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: read write

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6ACA1000	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 1073008	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6ACA1000
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: CB7008

Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ServiceValid_testv2\RoboTaskLite.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\{F8562070-9974-4B8E-BAB8-308A662C9869}\ISBEW64.exe

Code function: 4_2_00007FF6EF1A1128 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_00007FF6EF1A1128

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 25.2.MSBuild.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.cmd.exe.62100c8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.cmd.exe.62100c8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.cmd.exe.51000c8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.cmd.exe.51000c8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2316820013.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1995781637.0000000006210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2314418981.0000000000F02000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 8284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 8688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 9048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 9176, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nxscuox, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\oby, type: DROPPED

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 8688, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 25.2.MSBuild.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.cmd.exe.62100c8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.cmd.exe.62100c8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.cmd.exe.51000c8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.cmd.exe.51000c8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2316820013.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1995781637.0000000006210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2314418981.0000000000F02000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 8284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 8688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 9048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 9176, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nxscuox, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\oby, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 25.2.MSBuild.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.cmd.exe.62100c8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.cmd.exe.62100c8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.cmd.exe.51000c8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.cmd.exe.51000c8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.2316820013.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1995781637.0000000006210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2314418981.0000000000F02000.00000002.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 8284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 8688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 9048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 9176, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nxscuox, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\oby, type: DROPPED

Yara detected SectopRAT

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 8688, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\{EE8A0717-C2AE-4188-8BEC-631BE53427B8}\RoboTaskLite.exe

Code function: 14_2_50CB8080 @Vcl@Consts@_SInvalidTabIndex,@Vcl@Consts@_SInvalidTabStyle,@Vcl@Consts@_SInvalidBitmap,

14_2_50CB8080

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	221 Windows Management Instrumentation	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	2 Data from Local System	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	211 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	2 Clipboard Data	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	225 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	351 Security Software Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 DLL Side-Loading	Cached Domain Credentials	11 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	251 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WNBOZYUN.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
WNBOZYUN.msi