Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
7I7TOCVsCr.exe

Overview

General Information

Sample name:7I7TOCVsCr.exe
renamed because original name is a hash value
Original sample name:e111964765f99e0c863956e31e31ef76e5989cef5c33673ae955230d8cb9c4e2.exe
Analysis ID:1633565
MD5:89835939251de14ca92a6fc263faf6ff
SHA1:67f125429fa563fd17cb0095549932c80b32f764
SHA256:e111964765f99e0c863956e31e31ef76e5989cef5c33673ae955230d8cb9c4e2
Tags:exeuser-adrian__luca
Infos:

Detection

XWorm
Score:100
Range:0 - 100
Confidence:100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Protects its processes via BreakOnTermination flag
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • 7I7TOCVsCr.exe (PID: 2672 cmdline: "C:\Users\user\Desktop\7I7TOCVsCr.exe" MD5: 89835939251DE14CA92A6FC263FAF6FF)
    • 7I7TOCVsCr.exe (PID: 5296 cmdline: "C:\Users\user\Desktop\7I7TOCVsCr.exe" MD5: 89835939251DE14CA92A6FC263FAF6FF)
      • WerFault.exe (PID: 7904 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 1960 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
XWormMalware with wide range of capabilities ranging from RAT to ransomware.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["rency.ydns.eu", "wqo9.firewall-gateway.de"], "Port": 59012, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.875429439.0000000003019000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_XWormYara detected XWormJoe Security
    00000000.00000002.875429439.0000000003019000.00000004.00000800.00020000.00000000.sdmpMALWARE_Win_AsyncRATDetects AsyncRATditekSHen
    • 0x177d2:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
    • 0x1786f:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
    • 0x17984:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
    • 0x16766:$cnc4: POST / HTTP/1.1
    00000001.00000002.2306935663.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_XWormYara detected XWormJoe Security
      00000001.00000002.2306935663.0000000000402000.00000040.00000400.00020000.00000000.sdmpMALWARE_Win_AsyncRATDetects AsyncRATditekSHen
      • 0xff72:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
      • 0x1000f:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
      • 0x10124:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
      • 0xef06:$cnc4: POST / HTTP/1.1
      00000001.00000002.2309107475.0000000002D11000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_XWormYara detected XWormJoe Security
        Click to see the 5 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        0.2.7I7TOCVsCr.exe.300544c.2.unpackJoeSecurity_XWormYara detected XWormJoe Security
          0.2.7I7TOCVsCr.exe.300544c.2.unpackrat_win_xworm_v3Finds XWorm (version XClient, v3) samples based on characteristic stringsSekoia.io
          • 0xa761:$str01: $VB$Local_Port
          • 0xa785:$str02: $VB$Local_Host
          • 0x8877:$str03: get_Jpeg
          • 0x900e:$str04: get_ServicePack
          • 0xb9a3:$str05: Select * from AntivirusProduct
          • 0xc605:$str06: PCRestart
          • 0xc619:$str07: shutdown.exe /f /r /t 0
          • 0xc6cb:$str08: StopReport
          • 0xc6a1:$str09: StopDDos
          • 0xc797:$str10: sendPlugin
          • 0xc935:$str12: -ExecutionPolicy Bypass -File "
          • 0xd3eb:$str13: Content-length: 5235
          0.2.7I7TOCVsCr.exe.300544c.2.unpackMALWARE_Win_AsyncRATDetects AsyncRATditekSHen
          • 0xe372:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
          • 0xe40f:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1
          • 0xe524:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
          • 0xd306:$cnc4: POST / HTTP/1.1
          0.2.7I7TOCVsCr.exe.2faadfc.3.unpackJoeSecurity_XWormYara detected XWormJoe Security
            0.2.7I7TOCVsCr.exe.2faadfc.3.unpackrat_win_xworm_v3Finds XWorm (version XClient, v3) samples based on characteristic stringsSekoia.io
            • 0xa761:$str01: $VB$Local_Port
            • 0xa785:$str02: $VB$Local_Host
            • 0x8877:$str03: get_Jpeg
            • 0x900e:$str04: get_ServicePack
            • 0xb9a3:$str05: Select * from AntivirusProduct
            • 0xc605:$str06: PCRestart
            • 0xc619:$str07: shutdown.exe /f /r /t 0
            • 0xc6cb:$str08: StopReport
            • 0xc6a1:$str09: StopDDos
            • 0xc797:$str10: sendPlugin
            • 0xc935:$str12: -ExecutionPolicy Bypass -File "
            • 0xd3eb:$str13: Content-length: 5235
            Click to see the 10 entries

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Startup Folder File Write
            Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\7I7TOCVsCr.exe, ProcessId: 5296, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicroSoftOutlook.lnk

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-03-10T13:37:15.886059+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:37:29.682890+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:37:30.770393+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:37:43.486174+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:37:45.353135+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:37:45.859159+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:37:56.891111+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:37:57.012915+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:37:57.161961+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:00.774580+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:10.929286+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:13.243609+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:18.433366+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:23.555122+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:30.288281+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:30.772609+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:34.635177+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:34.778643+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:35.564909+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:46.331388+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:51.070270+010028528701Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-03-10T13:37:29.685357+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:37:43.489992+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:37:45.356339+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:37:45.865716+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:37:56.899703+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:37:57.014821+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:37:57.163894+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:38:10.931630+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:38:13.245513+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:38:18.435983+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:38:23.556768+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:38:30.289916+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:38:34.639953+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:38:34.780149+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:38:35.590098+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:38:46.333088+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            2025-03-10T13:38:51.073545+010028529231Malware Command and Control Activity Detected192.168.2.749687104.245.240.12359012TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-03-10T13:37:30.770393+010028528741Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:00.774580+010028528741Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            2025-03-10T13:38:30.772609+010028528741Malware Command and Control Activity Detected104.245.240.12359012192.168.2.749687TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2025-03-10T13:36:51.705373+010028559241Malware Command and Control Activity Detected192.168.2.749681104.245.240.15859012TCP

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus detection for URL or domain
            Source: wqo9.firewall-gateway.deAvira URL Cloud: Label: malware
            Found malware configuration
            Source: 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: Xworm {"C2 url": ["rency.ydns.eu", "wqo9.firewall-gateway.de"], "Port": 59012, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}
            Multi AV Scanner detection for dropped file
            Source: C:\Users\user\AppData\Roaming\MicroSoftOutlook.exeReversingLabs: Detection: 71%
            Multi AV Scanner detection for submitted file
            Source: 7I7TOCVsCr.exeVirustotal: Detection: 77%Perma Link
            Source: 7I7TOCVsCr.exeReversingLabs: Detection: 71%
            Joe Sandbox ML detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Sample uses string decryption to hide its real strings
            Source: 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmpString decryptor: rency.ydns.eu,wqo9.firewall-gateway.de
            Source: 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmpString decryptor: 59012
            Source: 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmpString decryptor: <123456789>
            Source: 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmpString decryptor: <Xwormmm>
            Source: 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmpString decryptor: Windows Session Manager
            Source: 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmpString decryptor: USB.exe
            Source: 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmpString decryptor: %AppData%
            Source: 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmpString decryptor: MicroSoftOutlook.exe
            Source: 7I7TOCVsCr.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: 7I7TOCVsCr.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: System.Xml.ni.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F36000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Accessibility.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbC source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F36000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: System.ni.pdbRSDS source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: Accessibility.pdbpb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: %%.pdb s( source: 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp
            Source: Binary string: System.Drawing.pdb#( source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Configuration.ni.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F36000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\Desktop\vSvz.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000FEC000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mscorlib.ni.pdbRSDS source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: mscorlib.pdbp source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Configuration.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Xml.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Xml.ni.pdbRSDS# source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Core.ni.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: Microsoft.VisualBasic.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: @mo.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp
            Source: Binary string: System.Windows.Forms.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb'r source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000FEC000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mscorlib.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F36000.00000004.00000020.00020000.00000000.sdmp, 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp, 7I7TOCVsCr.exe, 00000001.00000002.2313026771.00000000067A0000.00000004.00000020.00020000.00000000.sdmp, WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Management.ni.pdbRSDSJ< source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Drawing.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Management.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: mscorlib.ni.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: vSvz.pdbSHA256 source: 7I7TOCVsCr.exe, MicroSoftOutlook.exe.1.dr
            Source: Binary string: ?moC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp
            Source: Binary string: System.Management.ni.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Core.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb<r source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000FEC000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: symbols\dll\mscorlib.pdbLb source: 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp
            Source: Binary string: C:\Windows\vSvz.pdbpdbSvz.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F36000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\Desktop\7I7TOCVsCr.PDB source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F36000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: vSvz.pdb source: 7I7TOCVsCr.exe, MicroSoftOutlook.exe.1.dr
            Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb`M source: 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp
            Source: Binary string: System.ni.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Core.ni.pdbRSDS source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: HPao0C:\Windows\mscorlib.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 4x nop then jmp 076D9E9Bh0_2_076DA122

            Networking

            barindex
            Suricata IDS alerts for network traffic
            Source: Network trafficSuricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.7:49681 -> 104.245.240.158:59012
            Source: Network trafficSuricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 104.245.240.123:59012 -> 192.168.2.7:49687
            Source: Network trafficSuricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.7:49687 -> 104.245.240.123:59012
            Source: Network trafficSuricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 104.245.240.123:59012 -> 192.168.2.7:49687
            C2 URLs / IPs found in malware configuration
            Source: Malware configuration extractorURLs: rency.ydns.eu
            Source: Malware configuration extractorURLs: wqo9.firewall-gateway.de
            Connects to many ports of the same IP (likely port scanning)
            Source: global trafficTCP traffic: 104.245.240.158 ports 59012,0,1,2,5,9
            Source: global trafficTCP traffic: 104.245.240.123 ports 59012,0,1,2,5,9
            Source: global trafficTCP traffic: 192.168.2.7:49681 -> 104.245.240.158:59012
            Source: global trafficTCP traffic: 192.168.2.7:49687 -> 104.245.240.123:59012
            Source: Joe Sandbox ViewASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
            Source: Joe Sandbox ViewASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficDNS traffic detected: DNS query: wqo9.firewall-gateway.de
            Source: global trafficDNS traffic detected: DNS query: rency.ydns.eu
            Source: 7I7TOCVsCr.exe, 00000001.00000002.2309107475.0000000002D11000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: 7I7TOCVsCr.exe, MicroSoftOutlook.exe.1.drString found in binary or memory: http://tempuri.org/EchipamenteDataSet.xsd
            Source: Amcache.hve.14.drString found in binary or memory: http://upx.sf.net

            Operating System Destruction

            barindex
            Protects its processes via BreakOnTermination flag
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: 01 00 00 00 Jump to behavior

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.unpack, type: UNPACKEDPEMatched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.unpack, type: UNPACKEDPEMatched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
            Source: 1.2.7I7TOCVsCr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
            Source: 1.2.7I7TOCVsCr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, type: UNPACKEDPEMatched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, type: UNPACKEDPEMatched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects AsyncRAT Author: ditekSHen
            Source: 00000000.00000002.875429439.0000000003019000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
            Source: 00000001.00000002.2306935663.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
            Source: 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects AsyncRAT Author: ditekSHen
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_015F42100_2_015F4210
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_015F6F900_2_015F6F90
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_015FDE740_2_015FDE74
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_055870180_2_05587018
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_055800400_2_05580040
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_055800060_2_05580006
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_05586FE10_2_05586FE1
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_07476F500_2_07476F50
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_07475F600_2_07475F60
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_0747EA430_2_0747EA43
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_076D77000_2_076D7700
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_076D76EF0_2_076D76EF
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_076D64600_2_076D6460
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_076D84E80_2_076D84E8
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_076D60280_2_076D6028
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_076D7B280_2_076D7B28
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_076D7B380_2_076D7B38
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 1_2_0116414F1_2_0116414F
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 1_2_011647481_2_01164748
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 1_2_011614701_2_01161470
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 1_2_0116F6701_2_0116F670
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 1_2_01163B301_2_01163B30
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 1960
            Source: 7I7TOCVsCr.exe, 00000000.00000002.874413687.000000000125E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exe, 00000000.00000002.876057845.0000000003FE0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exe, 00000000.00000002.878808871.0000000008D60000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exe, 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWindows Session Manager.exe4 vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exe, 00000000.00000002.875429439.0000000003019000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWindows Session Manager.exe4 vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exe, 00000000.00000000.856818518.0000000000C1E000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamevSvz.exe8 vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exe, 00000000.00000002.876057845.0000000003FA9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTL.dll" vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exe, 00000000.00000002.878037161.0000000007440000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTL.dll" vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exe, 00000000.00000002.875429439.0000000003035000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTL.dll" vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exe, 00000001.00000002.2312150154.0000000005B19000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exe, 00000001.00000002.2306935663.0000000000414000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWindows Session Manager.exe4 vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exe, 00000001.00000002.2311213050.0000000003D11000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevSvz.exe8 vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F08000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exeBinary or memory string: OriginalFilenamevSvz.exe8 vs 7I7TOCVsCr.exe
            Source: 7I7TOCVsCr.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.unpack, type: UNPACKEDPEMatched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.unpack, type: UNPACKEDPEMatched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
            Source: 1.2.7I7TOCVsCr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
            Source: 1.2.7I7TOCVsCr.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, type: UNPACKEDPEMatched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, type: UNPACKEDPEMatched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
            Source: 00000000.00000002.875429439.0000000003019000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
            Source: 00000001.00000002.2306935663.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
            Source: 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
            Source: 7I7TOCVsCr.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, 5Qr5V2aNWCcdYn70pbgmQULMpvNQ94nj.csCryptographic APIs: 'TransformFinalBlock'
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, FXGyLuigTPD9Vpab9VsegLmV1pqpKqi7.csCryptographic APIs: 'TransformFinalBlock'
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, FXGyLuigTPD9Vpab9VsegLmV1pqpKqi7.csCryptographic APIs: 'TransformFinalBlock'
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, 5Qr5V2aNWCcdYn70pbgmQULMpvNQ94nj.csCryptographic APIs: 'TransformFinalBlock'
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, FXGyLuigTPD9Vpab9VsegLmV1pqpKqi7.csCryptographic APIs: 'TransformFinalBlock'
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, FXGyLuigTPD9Vpab9VsegLmV1pqpKqi7.csCryptographic APIs: 'TransformFinalBlock'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, utR61RBcBegxYFsMxm.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, utR61RBcBegxYFsMxm.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, utR61RBcBegxYFsMxm.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, utR61RBcBegxYFsMxm.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, utR61RBcBegxYFsMxm.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, utR61RBcBegxYFsMxm.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, utR61RBcBegxYFsMxm.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, utR61RBcBegxYFsMxm.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, utR61RBcBegxYFsMxm.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, GAqQ6XasuiYgyyyAGh.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, GAqQ6XasuiYgyyyAGh.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, dLiNKQaU0GLrnqDgfn9MKAjxEXAjUsCS5VFq7cg58lAoMo8IL0VaN74ez99xHY9Zksv9JRhkiG8BEwAEmtxuRjh1Yh.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, dLiNKQaU0GLrnqDgfn9MKAjxEXAjUsCS5VFq7cg58lAoMo8IL0VaN74ez99xHY9Zksv9JRhkiG8BEwAEmtxuRjh1Yh.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, GAqQ6XasuiYgyyyAGh.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, GAqQ6XasuiYgyyyAGh.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, GAqQ6XasuiYgyyyAGh.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, GAqQ6XasuiYgyyyAGh.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, dLiNKQaU0GLrnqDgfn9MKAjxEXAjUsCS5VFq7cg58lAoMo8IL0VaN74ez99xHY9Zksv9JRhkiG8BEwAEmtxuRjh1Yh.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, dLiNKQaU0GLrnqDgfn9MKAjxEXAjUsCS5VFq7cg58lAoMo8IL0VaN74ez99xHY9Zksv9JRhkiG8BEwAEmtxuRjh1Yh.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
            Source: classification engineClassification label: mal100.troj.evad.winEXE@4/10@2/2
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7I7TOCVsCr.exe.logJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMutant created: NULL
            Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5296
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMutant created: \Sessions\1\BaseNamedObjects\0QDhg9mCIkYog25F
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeFile created: C:\Users\user\AppData\Local\Temp\Log.tmpJump to behavior
            Source: 7I7TOCVsCr.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: 7I7TOCVsCr.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: 7I7TOCVsCr.exe, 00000000.00000000.856750587.0000000000B72000.00000002.00000001.01000000.00000003.sdmp, 7I7TOCVsCr.exe, 00000001.00000002.2311213050.0000000003D11000.00000004.00000800.00020000.00000000.sdmp, MicroSoftOutlook.exe.1.drBinary or memory string: INSERT INTO [dbo].[Table] ([Id], [Nume], [Grupa_muschi], [Data_livrare], [Pret]) VALUES (@Id, @Nume, @Grupa_muschi, @Data_livrare, @Pret);
            Source: 7I7TOCVsCr.exe, 00000000.00000000.856750587.0000000000B72000.00000002.00000001.01000000.00000003.sdmp, 7I7TOCVsCr.exe, 00000001.00000002.2311213050.0000000003D11000.00000004.00000800.00020000.00000000.sdmp, MicroSoftOutlook.exe.1.drBinary or memory string: UPDATE [dbo].[Table] SET [Id] = @Id, [Nume] = @Nume, [Grupa_muschi] = @Grupa_muschi, [Data_livrare] = @Data_livrare, [Pret] = @Pret WHERE (([Id] = @Original_Id) AND ([Nume] = @Original_Nume) AND ([Grupa_muschi] = @Original_Grupa_muschi) AND ([Data_livrare] = @Original_Data_livrare) AND ([Pret] = @Original_Pret));
            Source: 7I7TOCVsCr.exeVirustotal: Detection: 77%
            Source: 7I7TOCVsCr.exeReversingLabs: Detection: 71%
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeFile read: C:\Users\user\Desktop\7I7TOCVsCr.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\7I7TOCVsCr.exe "C:\Users\user\Desktop\7I7TOCVsCr.exe"
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess created: C:\Users\user\Desktop\7I7TOCVsCr.exe "C:\Users\user\Desktop\7I7TOCVsCr.exe"
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 1960
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess created: C:\Users\user\Desktop\7I7TOCVsCr.exe "C:\Users\user\Desktop\7I7TOCVsCr.exe"Jump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: scrrun.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: linkinfo.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: ntshrui.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: cscapi.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: avicap32.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: msvfw32.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
            Source: 7I7TOCVsCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: 7I7TOCVsCr.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: 7I7TOCVsCr.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: System.Xml.ni.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F36000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Accessibility.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbC source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F36000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: System.ni.pdbRSDS source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: Accessibility.pdbpb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: %%.pdb s( source: 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp
            Source: Binary string: System.Drawing.pdb#( source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Configuration.ni.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F36000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\Desktop\vSvz.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000FEC000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mscorlib.ni.pdbRSDS source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: mscorlib.pdbp source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Configuration.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Xml.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Xml.ni.pdbRSDS# source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Core.ni.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: Microsoft.VisualBasic.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: @mo.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp
            Source: Binary string: System.Windows.Forms.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb'r source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000FEC000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: mscorlib.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F36000.00000004.00000020.00020000.00000000.sdmp, 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp, 7I7TOCVsCr.exe, 00000001.00000002.2313026771.00000000067A0000.00000004.00000020.00020000.00000000.sdmp, WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Management.ni.pdbRSDSJ< source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Drawing.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Management.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: mscorlib.ni.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: vSvz.pdbSHA256 source: 7I7TOCVsCr.exe, MicroSoftOutlook.exe.1.dr
            Source: Binary string: ?moC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp
            Source: Binary string: System.Management.ni.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Core.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb<r source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000FEC000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: symbols\dll\mscorlib.pdbLb source: 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp
            Source: Binary string: C:\Windows\vSvz.pdbpdbSvz.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F36000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \??\C:\Users\user\Desktop\7I7TOCVsCr.PDB source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F36000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: vSvz.pdb source: 7I7TOCVsCr.exe, MicroSoftOutlook.exe.1.dr
            Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb`M source: 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp
            Source: Binary string: System.ni.pdb source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: System.Core.ni.pdbRSDS source: WERDB24.tmp.dmp.14.dr
            Source: Binary string: HPao0C:\Windows\mscorlib.pdb source: 7I7TOCVsCr.exe, 00000001.00000002.2312830226.0000000005FEA000.00000004.00000010.00020000.00000000.sdmp

            Data Obfuscation

            barindex
            .NET source code contains method to dynamically call methods (often used by packers)
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, F4RGvMuj4U5T65cao0T2zsRWeZG2uQx8.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{CHmzyYZA9cgfj3YyRnpXSfYR0bSLRZpZVYv8N6YwZVL0adnscLSd4FBRnCeCtG5BHclVDrGYefh3Kmjs2TERgJrj9B.G0raM1kPDEMMlhPB9yl5P9u5pPZc6lhTHLHIEXqsmIRqdQxroTsfHDdQsQJxCXG73pb03OUmGncvFXYIZZNNoNjgRx,CHmzyYZA9cgfj3YyRnpXSfYR0bSLRZpZVYv8N6YwZVL0adnscLSd4FBRnCeCtG5BHclVDrGYefh3Kmjs2TERgJrj9B.NEK5VDa6oCy9DVn5hoy62UHZ2OmX9CVNL5bYbvH4dnkbpZcIiIZejNw6XeSIj6OMAzDLAJfvTr7vlaFwIDZTf5BL7m,CHmzyYZA9cgfj3YyRnpXSfYR0bSLRZpZVYv8N6YwZVL0adnscLSd4FBRnCeCtG5BHclVDrGYefh3Kmjs2TERgJrj9B._1WhPfMrIKDDl0ZM9S74QT61d9GUu7r472ut0CgDqCmnKNSBeENYKVfdbXPfx55DmlhPDioNwvxv7FJRhhU1gOncOdj,CHmzyYZA9cgfj3YyRnpXSfYR0bSLRZpZVYv8N6YwZVL0adnscLSd4FBRnCeCtG5BHclVDrGYefh3Kmjs2TERgJrj9B.QxoO2KJsgwe9ANp10ZfzVMpjq9ynLi9HhMez24Gf0SJPHJmVskiUHxzFQ5wAazTnh2ffKzUhc17kgo5NjpOinMsgwA,FXGyLuigTPD9Vpab9VsegLmV1pqpKqi7._6LtKvHyoh6zmhMDjIh()}}, (string[])null, (Type[])null, (bool[])null, true)
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, F4RGvMuj4U5T65cao0T2zsRWeZG2uQx8.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{_9kO15zmALBVwknd2wiZZDlpysYGL97Aj[2],FXGyLuigTPD9Vpab9VsegLmV1pqpKqi7.IeYFzbdVdcZpqL3jFx(Convert.FromBase64String(_9kO15zmALBVwknd2wiZZDlpysYGL97Aj[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, F4RGvMuj4U5T65cao0T2zsRWeZG2uQx8.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{CHmzyYZA9cgfj3YyRnpXSfYR0bSLRZpZVYv8N6YwZVL0adnscLSd4FBRnCeCtG5BHclVDrGYefh3Kmjs2TERgJrj9B.G0raM1kPDEMMlhPB9yl5P9u5pPZc6lhTHLHIEXqsmIRqdQxroTsfHDdQsQJxCXG73pb03OUmGncvFXYIZZNNoNjgRx,CHmzyYZA9cgfj3YyRnpXSfYR0bSLRZpZVYv8N6YwZVL0adnscLSd4FBRnCeCtG5BHclVDrGYefh3Kmjs2TERgJrj9B.NEK5VDa6oCy9DVn5hoy62UHZ2OmX9CVNL5bYbvH4dnkbpZcIiIZejNw6XeSIj6OMAzDLAJfvTr7vlaFwIDZTf5BL7m,CHmzyYZA9cgfj3YyRnpXSfYR0bSLRZpZVYv8N6YwZVL0adnscLSd4FBRnCeCtG5BHclVDrGYefh3Kmjs2TERgJrj9B._1WhPfMrIKDDl0ZM9S74QT61d9GUu7r472ut0CgDqCmnKNSBeENYKVfdbXPfx55DmlhPDioNwvxv7FJRhhU1gOncOdj,CHmzyYZA9cgfj3YyRnpXSfYR0bSLRZpZVYv8N6YwZVL0adnscLSd4FBRnCeCtG5BHclVDrGYefh3Kmjs2TERgJrj9B.QxoO2KJsgwe9ANp10ZfzVMpjq9ynLi9HhMez24Gf0SJPHJmVskiUHxzFQ5wAazTnh2ffKzUhc17kgo5NjpOinMsgwA,FXGyLuigTPD9Vpab9VsegLmV1pqpKqi7._6LtKvHyoh6zmhMDjIh()}}, (string[])null, (Type[])null, (bool[])null, true)
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, F4RGvMuj4U5T65cao0T2zsRWeZG2uQx8.cs.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{_9kO15zmALBVwknd2wiZZDlpysYGL97Aj[2],FXGyLuigTPD9Vpab9VsegLmV1pqpKqi7.IeYFzbdVdcZpqL3jFx(Convert.FromBase64String(_9kO15zmALBVwknd2wiZZDlpysYGL97Aj[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
            .NET source code contains potential unpacker
            Source: 7I7TOCVsCr.exe, Login.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, utR61RBcBegxYFsMxm.cs.Net Code: H66pul8KZj System.Reflection.Assembly.Load(byte[])
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, utR61RBcBegxYFsMxm.cs.Net Code: H66pul8KZj System.Reflection.Assembly.Load(byte[])
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, F4RGvMuj4U5T65cao0T2zsRWeZG2uQx8.cs.Net Code: gOIGZopd4222ZUGeO1kt9Nq94tVALXP1 System.AppDomain.Load(byte[])
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, F4RGvMuj4U5T65cao0T2zsRWeZG2uQx8.cs.Net Code: m4KehpttNHFLrnvM8ITor8LgDilthTDJ System.AppDomain.Load(byte[])
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, F4RGvMuj4U5T65cao0T2zsRWeZG2uQx8.cs.Net Code: m4KehpttNHFLrnvM8ITor8LgDilthTDJ
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, F4RGvMuj4U5T65cao0T2zsRWeZG2uQx8.cs.Net Code: gOIGZopd4222ZUGeO1kt9Nq94tVALXP1 System.AppDomain.Load(byte[])
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, F4RGvMuj4U5T65cao0T2zsRWeZG2uQx8.cs.Net Code: m4KehpttNHFLrnvM8ITor8LgDilthTDJ System.AppDomain.Load(byte[])
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, F4RGvMuj4U5T65cao0T2zsRWeZG2uQx8.cs.Net Code: m4KehpttNHFLrnvM8ITor8LgDilthTDJ
            Source: 0.2.7I7TOCVsCr.exe.7440000.8.raw.unpack, .cs.Net Code: System.Reflection.Assembly.Load(byte[])
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, utR61RBcBegxYFsMxm.cs.Net Code: H66pul8KZj System.Reflection.Assembly.Load(byte[])
            Source: 7I7TOCVsCr.exeStatic PE information: 0xDBA5471E [Wed Oct 9 22:45:50 2086 UTC]
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_076D9678 pushfd ; retf 0_2_076D9679
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_076D84D7 pushfd ; ret 0_2_076D84E1
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_076DCD4F push dword ptr [edx+ebp*2-75h]; iretd 0_2_076DCD5F
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeCode function: 0_2_076DBCE8 pushad ; iretd 0_2_076DBCF5
            Source: 7I7TOCVsCr.exeStatic PE information: section name: .text entropy: 7.37916546904803
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, yvU5BoedaOUElFudGN.csHigh entropy of concatenated method names: 'YIVtJPp5wI', 'e8JtIpWV9Z', 'Y82tuHu1mQ', 'BlntL8htQN', 'NPLtWTUdn4', 'jfVtCbIkS0', 'VkLtwdgQpq', 'jdhtaHFiuw', 'XKFt4kyKVZ', 'R71t5iS00P'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, ybhaVjKNYJ6Rw52lMZ.csHigh entropy of concatenated method names: 'tweNbay1kr', 'n6yN7Y4YVG', 'yT9NTwus4n', 'svvNfZawTW', 'wMENDxntqr', 'ekNNZmCe6s', 'qyYNk96MAf', 'xnYNx6I6MP', 'mNiNeAqxjs', 'wWHNcBRqfp'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, Aofa48Ap17SCL4oU8no.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NqCjN7kySH', 'VPKjr0oKc8', 'U84jFm3lfb', 'FUkjjg30pA', 'OBPjnL2324', 'syjjotwjAO', 'cmMjvWCLcG'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, j5mVEnRX2x3G3VRvF9.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'yZWUKbbBqM', 'gdUU6jGiCP', 'ggqUz5Zn2m', 'YRpqH0NVP7', 'INaqAHrBZH', 'eLmqUCgZw1', 'JQ8qqOJiMV', 'jDMDIlXrKnFShqfKmBm'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, GAqQ6XasuiYgyyyAGh.csHigh entropy of concatenated method names: 'B7sGShAGHO', 'FuSGM9bxPa', 'lVbG1GkUci', 'aZrG2oURm9', 'QHjG3mQIej', 'bQCGXYc0lN', 'kAdGdgQ89P', 'wZEGO7ZkK0', 'DbSGK1dr8h', 'N4LG6ld5xJ'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, swAlCG4YEdkcIZYAHq.csHigh entropy of concatenated method names: 'V7aRLCKfXG', 'fIWRCJ7rVV', 'QSTRa6P9V3', 'YQ0R427jN9', 'KpYREoyfl5', 'lVFR0cdTaG', 'OPERYjKPoC', 'uq4RsypWFZ', 'r30RNncRmm', 'GefRrkhO6x'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, xU18Cf1QefILmkxlKb.csHigh entropy of concatenated method names: 'ToString', 'kJU0l4qg3F', 'H1607Kq45P', 'Y1H0TYl6wN', 'ewE0ffVMgH', 'GIw0DaxOoC', 'cR70Zra5Kb', 'Oh00kj0AdG', 'bCq0xXBIq2', 'Fvw0eK0H4k'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, gxcJaF9hDRF2Cccoeq.csHigh entropy of concatenated method names: 'G5NyaUn7w8', 'DmUy4e1GY5', 'XLpybu9UY9', 'eKLy7JLNwk', 'WpQyfa0RLn', 'xsRyDXSbQO', 'D43ykiOobH', 'HhdyxKcoJS', 'OnBycD0uZX', 'zw2ylPQQay'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, HveiEyzlmFcmRqcgS5.csHigh entropy of concatenated method names: 'tvyrCjSKVq', 'Khhrax0cm5', 'TxIr4lQiYE', 'jyDrbl3V6Z', 'asir7jaNJV', 'QB6rfUHUFt', 'ux2rDDSYJF', 'qVGrvqCy2x', 'HparJRWpQr', 'ED1rITul12'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, BOu9a8UjtfZ0aZNvB5.csHigh entropy of concatenated method names: 'bFkuFeLFe', 'b7WLblJ8v', 'UUmCRpbG9', 'MXcwwvWWM', 'gnn4BWIL4', 'fdV5ZQMLs', 'A1lery0pCrr0jW36OY', 'hKkZN9J3wI42VXlPNF', 'QeusfhagW', 'YX1rG8N3E'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, hKVVgIkOptSme0OT77.csHigh entropy of concatenated method names: 'RmUtVJ3iXp', 'nnptRDriZJ', 'hF7tQvR3MD', 'VgCQ62Rxng', 'DIWQzEgdKW', 'ilItHJyWdm', 'kX3tA3vwke', 'wgUtUaNtIT', 'Hhctqc4RZP', 'zK6tpyTdjG'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, wnhOOHAALJ2IHClqNsU.csHigh entropy of concatenated method names: 'cB5r6GjDbg', 'yDhrzqWy42', 'E8AFHmUSkX', 'JSgFAhCAKh', 's4jFULIfpw', 'XJ5Fqma54j', 'LmxFpol20G', 'DupFhrSd4P', 'IZEFVoVUF1', 'i2RFG5QwpC'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, cFd7NwAqkM4Di55K07N.csHigh entropy of concatenated method names: 'lSHF6VWXhi', 'e60FzWYLaG', 'rRwjHdag7r', 'l1yCOrr3FoctcSqTid7', 'gGSE0PrN4enJlXoA6E2', 'MZuheOrQCUjfr9hBUoV', 'WUJ0W6ry0BFYPNS7TtT', 'BDmvZZrfFoGqqrQGlug', 'BpOREBrerUodxFeQhta'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, Ofsjm25G0qFlbZu6tX.csHigh entropy of concatenated method names: 'grfmWXwUkM', 'EhMmwE2n2n', 't8aRTbxxf5', 'CMYRfc0Vmp', 'aDPRDDSWDD', 'wTsRZ68bKw', 'qnORkmGRd9', 'MiLRxXRCut', 'pwrReE39hB', 'XnmRcKs73X'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, CGvFU5GSNkmbypFrIp.csHigh entropy of concatenated method names: 'Dispose', 'yQQAKE1Kbl', 'BFHU7mjbL4', 'UM8j3Ym8ZA', 'DCFA6rmtmb', 'BxLAzc3Nmt', 'ProcessDialogKey', 'GoIUHbhaVj', 'rYJUA6Rw52', 'OMZUUtnrTg'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, youlhSpBihKp5txDLV.csHigh entropy of concatenated method names: 'vx7AtAqQ6X', 'ruiABYgyyy', 'gYEA8dkcIZ', 'qAHAPqlfsj', 'Ku6AEtXusg', 'ukGA0TGqRQ', 'l2Nr5DCipDwPFGSwDY', 'v9p9fq6bUrCpLlPkRB', 'XYmAAdlGae', 'NiJAq1pFCR'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, ohJprSAHdUFmktERHwi.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lAWrlbHYj5', 'X7priT4sHm', 'ygKr9L8veq', 'eNhrS17C4A', 'n5yrMPsFKG', 'Yfyr1uMMMK', 'mx1r2eOQkQ'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, DjSA5EdCOIQQE1Kbla.csHigh entropy of concatenated method names: 'mAmNEUDdBi', 'Im8NY0sYEP', 'lo1NNq7SJf', 'LFoNFqqVad', 'L6NNnFJ2M6', 'PdVNvYY6sO', 'Dispose', 'i9JsVwCTem', 'PVWsGUcwmt', 'P2IsR8YmGG'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, zsgjkGbTGqRQsPVDRf.csHigh entropy of concatenated method names: 'L7mQhgEht6', 'CQZQGn3Sui', 'a2kQm9grWI', 'xWpQthlAbK', 'IstQBFKCUD', 'mwXm31tYbK', 'mFDmXdSkbO', 'xivmdZCEOw', 'PsOmOxJKMW', 'R7UmKp7RWe'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, jnrTgk6CXB6CSrtxBc.csHigh entropy of concatenated method names: 'V2UrRivSIk', 'UKyrmLpadX', 'EmtrQoKSm4', 'WBnrt5VP8y', 'VAtrNRWvi4', 'L3VrBlqNgh', 'Next', 'Next', 'Next', 'NextBytes'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, NlnXXwXaUFwFiD76SW.csHigh entropy of concatenated method names: 'hgoYOFvL8U', 'XGSY68TNve', 'uHDsHg8B4T', 'WpBsAHkgda', 'fJVYlugsqL', 'uc5YiFAaWI', 'QA1Y9aSoSM', 'NJbYSiJa5Z', 'KH6YMc224i', 'PmMY1i6Umy'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, utR61RBcBegxYFsMxm.csHigh entropy of concatenated method names: 'LcsqhTXNrw', 'R5jqVcDxgH', 'POBqG1bDfU', 'MgdqRPCuQi', 'l4ZqmGUVY6', 'yb0qQO0NDl', 'eWPqtXS7Ci', 'A9SqBM2rEq', 'mffqgNn3Hd', 'jRjq8JHFoQ'
            Source: 0.2.7I7TOCVsCr.exe.4148f40.6.raw.unpack, nxn0n12nXpx7fWu3rG.csHigh entropy of concatenated method names: 'YU8Y8wWuDr', 'sGaYP7XCOV', 'ToString', 'v5HYVKemP6', 'hvYYGMxBgK', 'kljYRkCbmV', 'bvLYmWYlr4', 'LdXYQnaNUc', 'xKgYtyFjro', 'z20YBtMKB4'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, yvU5BoedaOUElFudGN.csHigh entropy of concatenated method names: 'YIVtJPp5wI', 'e8JtIpWV9Z', 'Y82tuHu1mQ', 'BlntL8htQN', 'NPLtWTUdn4', 'jfVtCbIkS0', 'VkLtwdgQpq', 'jdhtaHFiuw', 'XKFt4kyKVZ', 'R71t5iS00P'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, ybhaVjKNYJ6Rw52lMZ.csHigh entropy of concatenated method names: 'tweNbay1kr', 'n6yN7Y4YVG', 'yT9NTwus4n', 'svvNfZawTW', 'wMENDxntqr', 'ekNNZmCe6s', 'qyYNk96MAf', 'xnYNx6I6MP', 'mNiNeAqxjs', 'wWHNcBRqfp'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, Aofa48Ap17SCL4oU8no.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NqCjN7kySH', 'VPKjr0oKc8', 'U84jFm3lfb', 'FUkjjg30pA', 'OBPjnL2324', 'syjjotwjAO', 'cmMjvWCLcG'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, j5mVEnRX2x3G3VRvF9.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'yZWUKbbBqM', 'gdUU6jGiCP', 'ggqUz5Zn2m', 'YRpqH0NVP7', 'INaqAHrBZH', 'eLmqUCgZw1', 'JQ8qqOJiMV', 'jDMDIlXrKnFShqfKmBm'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, GAqQ6XasuiYgyyyAGh.csHigh entropy of concatenated method names: 'B7sGShAGHO', 'FuSGM9bxPa', 'lVbG1GkUci', 'aZrG2oURm9', 'QHjG3mQIej', 'bQCGXYc0lN', 'kAdGdgQ89P', 'wZEGO7ZkK0', 'DbSGK1dr8h', 'N4LG6ld5xJ'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, swAlCG4YEdkcIZYAHq.csHigh entropy of concatenated method names: 'V7aRLCKfXG', 'fIWRCJ7rVV', 'QSTRa6P9V3', 'YQ0R427jN9', 'KpYREoyfl5', 'lVFR0cdTaG', 'OPERYjKPoC', 'uq4RsypWFZ', 'r30RNncRmm', 'GefRrkhO6x'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, xU18Cf1QefILmkxlKb.csHigh entropy of concatenated method names: 'ToString', 'kJU0l4qg3F', 'H1607Kq45P', 'Y1H0TYl6wN', 'ewE0ffVMgH', 'GIw0DaxOoC', 'cR70Zra5Kb', 'Oh00kj0AdG', 'bCq0xXBIq2', 'Fvw0eK0H4k'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, gxcJaF9hDRF2Cccoeq.csHigh entropy of concatenated method names: 'G5NyaUn7w8', 'DmUy4e1GY5', 'XLpybu9UY9', 'eKLy7JLNwk', 'WpQyfa0RLn', 'xsRyDXSbQO', 'D43ykiOobH', 'HhdyxKcoJS', 'OnBycD0uZX', 'zw2ylPQQay'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, HveiEyzlmFcmRqcgS5.csHigh entropy of concatenated method names: 'tvyrCjSKVq', 'Khhrax0cm5', 'TxIr4lQiYE', 'jyDrbl3V6Z', 'asir7jaNJV', 'QB6rfUHUFt', 'ux2rDDSYJF', 'qVGrvqCy2x', 'HparJRWpQr', 'ED1rITul12'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, BOu9a8UjtfZ0aZNvB5.csHigh entropy of concatenated method names: 'bFkuFeLFe', 'b7WLblJ8v', 'UUmCRpbG9', 'MXcwwvWWM', 'gnn4BWIL4', 'fdV5ZQMLs', 'A1lery0pCrr0jW36OY', 'hKkZN9J3wI42VXlPNF', 'QeusfhagW', 'YX1rG8N3E'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, hKVVgIkOptSme0OT77.csHigh entropy of concatenated method names: 'RmUtVJ3iXp', 'nnptRDriZJ', 'hF7tQvR3MD', 'VgCQ62Rxng', 'DIWQzEgdKW', 'ilItHJyWdm', 'kX3tA3vwke', 'wgUtUaNtIT', 'Hhctqc4RZP', 'zK6tpyTdjG'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, wnhOOHAALJ2IHClqNsU.csHigh entropy of concatenated method names: 'cB5r6GjDbg', 'yDhrzqWy42', 'E8AFHmUSkX', 'JSgFAhCAKh', 's4jFULIfpw', 'XJ5Fqma54j', 'LmxFpol20G', 'DupFhrSd4P', 'IZEFVoVUF1', 'i2RFG5QwpC'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, cFd7NwAqkM4Di55K07N.csHigh entropy of concatenated method names: 'lSHF6VWXhi', 'e60FzWYLaG', 'rRwjHdag7r', 'l1yCOrr3FoctcSqTid7', 'gGSE0PrN4enJlXoA6E2', 'MZuheOrQCUjfr9hBUoV', 'WUJ0W6ry0BFYPNS7TtT', 'BDmvZZrfFoGqqrQGlug', 'BpOREBrerUodxFeQhta'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, Ofsjm25G0qFlbZu6tX.csHigh entropy of concatenated method names: 'grfmWXwUkM', 'EhMmwE2n2n', 't8aRTbxxf5', 'CMYRfc0Vmp', 'aDPRDDSWDD', 'wTsRZ68bKw', 'qnORkmGRd9', 'MiLRxXRCut', 'pwrReE39hB', 'XnmRcKs73X'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, CGvFU5GSNkmbypFrIp.csHigh entropy of concatenated method names: 'Dispose', 'yQQAKE1Kbl', 'BFHU7mjbL4', 'UM8j3Ym8ZA', 'DCFA6rmtmb', 'BxLAzc3Nmt', 'ProcessDialogKey', 'GoIUHbhaVj', 'rYJUA6Rw52', 'OMZUUtnrTg'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, youlhSpBihKp5txDLV.csHigh entropy of concatenated method names: 'vx7AtAqQ6X', 'ruiABYgyyy', 'gYEA8dkcIZ', 'qAHAPqlfsj', 'Ku6AEtXusg', 'ukGA0TGqRQ', 'l2Nr5DCipDwPFGSwDY', 'v9p9fq6bUrCpLlPkRB', 'XYmAAdlGae', 'NiJAq1pFCR'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, ohJprSAHdUFmktERHwi.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lAWrlbHYj5', 'X7priT4sHm', 'ygKr9L8veq', 'eNhrS17C4A', 'n5yrMPsFKG', 'Yfyr1uMMMK', 'mx1r2eOQkQ'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, DjSA5EdCOIQQE1Kbla.csHigh entropy of concatenated method names: 'mAmNEUDdBi', 'Im8NY0sYEP', 'lo1NNq7SJf', 'LFoNFqqVad', 'L6NNnFJ2M6', 'PdVNvYY6sO', 'Dispose', 'i9JsVwCTem', 'PVWsGUcwmt', 'P2IsR8YmGG'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, zsgjkGbTGqRQsPVDRf.csHigh entropy of concatenated method names: 'L7mQhgEht6', 'CQZQGn3Sui', 'a2kQm9grWI', 'xWpQthlAbK', 'IstQBFKCUD', 'mwXm31tYbK', 'mFDmXdSkbO', 'xivmdZCEOw', 'PsOmOxJKMW', 'R7UmKp7RWe'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, jnrTgk6CXB6CSrtxBc.csHigh entropy of concatenated method names: 'V2UrRivSIk', 'UKyrmLpadX', 'EmtrQoKSm4', 'WBnrt5VP8y', 'VAtrNRWvi4', 'L3VrBlqNgh', 'Next', 'Next', 'Next', 'NextBytes'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, NlnXXwXaUFwFiD76SW.csHigh entropy of concatenated method names: 'hgoYOFvL8U', 'XGSY68TNve', 'uHDsHg8B4T', 'WpBsAHkgda', 'fJVYlugsqL', 'uc5YiFAaWI', 'QA1Y9aSoSM', 'NJbYSiJa5Z', 'KH6YMc224i', 'PmMY1i6Umy'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, utR61RBcBegxYFsMxm.csHigh entropy of concatenated method names: 'LcsqhTXNrw', 'R5jqVcDxgH', 'POBqG1bDfU', 'MgdqRPCuQi', 'l4ZqmGUVY6', 'yb0qQO0NDl', 'eWPqtXS7Ci', 'A9SqBM2rEq', 'mffqgNn3Hd', 'jRjq8JHFoQ'
            Source: 0.2.7I7TOCVsCr.exe.8d60000.9.raw.unpack, nxn0n12nXpx7fWu3rG.csHigh entropy of concatenated method names: 'YU8Y8wWuDr', 'sGaYP7XCOV', 'ToString', 'v5HYVKemP6', 'hvYYGMxBgK', 'kljYRkCbmV', 'bvLYmWYlr4', 'LdXYQnaNUc', 'xKgYtyFjro', 'z20YBtMKB4'
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, CHmzyYZA9cgfj3YyRnpXSfYR0bSLRZpZVYv8N6YwZVL0adnscLSd4FBRnCeCtG5BHclVDrGYefh3Kmjs2TERgJrj9B.csHigh entropy of concatenated method names: 'rUrlRFJz30faaab11oHTcakzf5AIlJdvsmXpLNAUhNCIpj0vPL', '_8hd0AxtuVa5N2QkSm7QRnsJdB51FrU0vcMRFKUDo9WQXXILK7O', 'XBaKvfuhxf76waGiEaqVXUATUA9TQ1dWbrqvAziNcgckLtgaZr', 'BFGLVzxnfZ4HfjHCawIZXfjDVgtdEfbRuroXUwWofu8amEHaip'
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, mq9QcI7Xrgyz6KYxjx.csHigh entropy of concatenated method names: '_0H7VvUXRvMWg0DHxIG', 'OM7SKlNTOw3pkAzvAQ', 'wh70CxnZQPOCA2ikeM', 'IsbCa5BKwb', 'hdgz22yvVV', 'lwLuif6JI8', '_5SvhFn9TZk', 'VfN0LfoPyz', 'Te736jdmOz', 'jKCT6aH1EM'
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, 1DBeL0fJpz6ESB4fPHYA2Ng4YyI86sB5IboGlaYNrhW4CF1qIIrjEfr5XX.csHigh entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'N7aoDED4EiUmgKudyh5Ppat1FUeMJeP7En0aaumz6QMnClgs7y', '_7XXNVYII33E3Sc8FXzSVNqCJaoKwSS1sI88VRz7HWmhKL2thxK', '_0gIjTVKW9PapISJ6Mcdunyvx1GWpWfW7oZgkAfUDfy5ppa9QfD', 'bR5XLA4JRmRJiqfDq16efkahVAfv2phuK30XIZe52h1ilMpkpX'
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, j9Qok6fMJKSSZIinblf0yiUbFfVLHiJ5.csHigh entropy of concatenated method names: '_4Mla20W5B3utOFq8wuF6bgcAchZ2xNCs', 'R1ToEvIz6LMc4OiM9fNQKsbasBE6krOR', 'v9JcPLx2L4e0D9qAxD9OnibJaKq9qrgV', 'Sa2v1gbxX1GaiS54V5dqG2ZZPQ4eVjue', 'JZr1pr3KJDNJR6vnJgJJe4TcbYvvzQZe', 'qwLnweIXdy1pcGusaAlbwT2mUWIssJPW', 'MLf08p4c2kK6kz9UnpWtIm7XlXuMPzpb', 'RoPTiV1OVVcVA3AjffCnDblDgeDLm1kK', 'nfBlWdXEs9wuYCYgGBFokN4uZJd8okXq', 'ctFuKyz5Ac9BzoYnUMbmEepdHXcSQtfw'
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, HcQ4iO03N6fzcmrZoUVrBKnFoxaK0bsa.csHigh entropy of concatenated method names: '_98dAAosE3lMGVdoQcEp6QvyJrEo6HF6Q', 'b38mr22MXZlWBlYDPyw4h0aKijYF4Oez', 'Q9GybaqbZino5Z8xkNmYx6olwxjWjk2P', 'gl7kLE9vYQy3Qu4ocJnTGEoEI1kfqADU', 'Q3dFUblFrIIH7YGqx41edXckc0vWeqHAwpOkPDgX1neYOEhJsoYgquxUKiDC3SpXw09', 'KB8P1HrdbVPUkIV2E4L40i0sTjRSOVR3hXuXOyQKj5Cr4UY0rp0ePJInbnl8v7Se7TN', 'qFTsKUu4ttzg2KqXKJhhy7pRwAzufis752ZP91obuFLf11usFGK9mwZmh1zeJxVxx2t', 'TaXbbHEh7LS78WACgSSS8sQmiwCOBJQDYXc4HLRMroVSWi8yYcdFROJoTfBJBSI7OoV', 'jL0vPZkvxb94VfkRs4LCEQyHw7YuDjcQUlAJt0ixJrbKhbxLG6tOGTX8noZIJHHO7xM', '_0QuDN68C20pjju21nyoI8bMgvf7gm3dMU1cnSxeUmYk6w2qluxVor2oAMJOuk3hyE0Y'
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, F4RGvMuj4U5T65cao0T2zsRWeZG2uQx8.csHigh entropy of concatenated method names: '_9bjyqOOdTM9fxFh8BtwbGN6SaBXG8CRN', 'gOIGZopd4222ZUGeO1kt9Nq94tVALXP1', 'Kg4wpSabxBU3kQYn68wDwgaZJLOL31bB', 'IZ525wro1Ygb4SdwLGXqdvJVz3APLDki', '_9tdX2eX1NxpTUXQfMcQT3Y4ohPsI3lC4', 'mXd28UpiMMoSXFz6mB2yNLT2CYiHKamu', 'A5mxzzWegS5TetGmJIJ4xZ2rDvLnHyu5', 'wqVngGpOOwusRvaagnCtB8OXUwqx2FzD', 'nQ68vI1LDSEZn12giYTc7pMYiVpKOl2E', 'r7Sw74RAvPmHwRla40j7oR7kwGdNKGUq'
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, QlwDLKHYlKx9EEtkonPHg1imYaaW6fCcivuPaRopEADljRsnbH1wJD2HPAeuPSbEDga9JRFZWxCop2RAaVPBHW1i77.csHigh entropy of concatenated method names: 'ZkJhHAMlE7UCkf5ASTYdrJLYx3QU79rxsVnsdV7qveTZj0zIC4C2JUlGR6IpW3d7ti7z43oRUKSCpVyRUFB1phQY7Z', '_4KGy0Ik8eibG4gBt6hHAK2zxd5DsOsfYAQkVaELHfl8fs2MU4QDxeh7aULHVcTOhjgQE1G14ND2QiEaZRdI4LYR754', 'Mz6E2EJcoCkC6THM2FWqaK7RoDUXKPDxWzIaLQLwuNyVEanECrU6lFfwK6MLD1gZMILoiX3Ih0ddK7S2NB2sJtuBU8', 'xdPOGJK3MKzVhq7uZfYNQoA9gA1udWcXNNxNmMvAoLEgYRxIEZgG3jW8RkQkI9yrb48OGzeKCxNy8CCQkYgd0Kp8ka', '_1cquv1UB1CC4GrjhiNm8DFGbS6k4hs10FeiEIln0SjQmF7R4AH', 'OYsTYRAytPyjm1EEJWMRmNHAVtwwx05y8m0h9QNNDgODnFN8gS', 'jTymyHwgvOGLO4S7CAbc8sdmK5QppbXw4fA3bkgPx6ZQSjFnr2', 'tEeV2TU6vuEAsTtpNknuUgBrFcKmoNNuabnodtpvX050ea9SMu', 'M6Cc8bKRn0MTr75tSd5vNkUfYhFsaVoZkTdDGFIBSvY5lIKtYu', '_8c8kFDfUZuMpKJHZv4jVExqQv16BsUtdHIWlEksTZs0herIi50'
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, KlMwnJsf8rnNpyquaW4QP4CMY3IDCj7V.csHigh entropy of concatenated method names: 's4CtUhSiaAb00xzAeHKf42A5876fK3Xm', 'QqNECHJmENMfsMNo69XccDF7P7OrC20tCjfVuycdRQUbc11QU00GhuMxXhZfDzTo0rY', 'af69LaoQC8iyzqwgFNtqAwK0BgyFpBwZaLq8plMQC4SihZ7ynndnPaUtw3mYDFkXENZ', 'vcndamzxlyNh7YuNCqD6Qskdj2pE9paLACgYT2CJ6QTGkqunNJ9onH1pTdTZ7bmtVS3', 'VGQk7AbzX5HD8d27cYnrpYdqGM965jvSpY0Dx0gROODVDqrM2XLxOyGq7JfdV7cZ0Os'
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, FXGyLuigTPD9Vpab9VsegLmV1pqpKqi7.csHigh entropy of concatenated method names: 't7Npip0kkDyIHLltHjjCaSAVh2smYBe3', '_4J6C0r6YC64Bepxb62OhJb3hIwlizPSN', 'jocDZ0vjxk41iKLQWGWhYCvWpPsew1Zc', 'drqv7umSGBLcs4yTG3OZR0XaGhoFedXO', 'gQdHEEM3vaLurBL9x7ZWh6QA3SUfWRqJ', 'FcTzsZ5zJMCjeWpFG4YnlWL8jUGWigfV', 'KX27SV4GYK72mAmA1sOSIudMrcU2bNO0', 'I5P8HwZjsYTLRqnJlPcTNVfSSmnTM1Bn', 'bkOyM3HyR8PhrlQx2NwVlIrZigTuxMg3', 'JQeUvoyWRXiNTqWuEe'
            Source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, dLiNKQaU0GLrnqDgfn9MKAjxEXAjUsCS5VFq7cg58lAoMo8IL0VaN74ez99xHY9Zksv9JRhkiG8BEwAEmtxuRjh1Yh.csHigh entropy of concatenated method names: 'TPYkdhHGwocoMsz560DR5iBMimTJMZdDD3u7a2nIWImThorDJAz4eqBkP7o9dPJTTfbzRxYitnokQJYcZJzZ7DC4Ah', 'GOCsIRC8Q4nxPKHXqlVYZ5dgfivBjQwCe2Kxxdb8IFeOZAtBw364Cv03TkkEffBaNiLarfjxK5whdiy0HE5su59oyk', '_56lKky7HKCiGvvufLeLrKkEFDX4TPeWABW9r7jwwm0C1Pajo9Jm4Z4RcseGY3CFS4Mf6ZD5opEPnAiRNzH12C06bLK', 'bHNyZdkKwRBJNfktdK6VQIb1NuLQoBtcPKZ6tGFucTfTKKm4jqov3mM6W5QJdsC5ZRzpuMduWjqrUpm9P0BBKR741K', 'VLPbdb734DEXFNzNMJgx6QTgA9iwBbyHmvxKyR2MZ0fj4LQvc0zGEPnoe3FIoGbdSfgL0ZqgqkenwCMQ8vr56sefvF', 'BkjLwdSRbbwL5qFgri1oUPFmhQNu9LHADxdc9c6okthNuVy7NZmLKDy0MNxGGB3U7GzNvVebpTCiykI7OawXjMDoER', '_01tZF8RV3h2rgfFjOtKvdXMif2JYt3xkKWHALfjwQKPPUYCmy3bUdFqbzhoi6LLc4YFPxCzeRreuCcNufLIcO6oUIV', '_6XhquSQL9HdoiTuxn16vZj4k0LJKyvlW4Xa10scaf6nNxRSnQ134buuPaVKX3DJnFfoSB7x5aPmh24pxUuR8Lm5AAN', 'E121lUQURp7GbT22eMW3SM98xRasZLYYQTClmUPUd5ZtEcwVp1mbXWd3J99hO7FvZEDSpjochsgOJxarZW14XBML4S', 'f3astxXuqIbWxUwsg1qNdIHO6iQLxwNasUpnluE6W5SV450uJrakPhGsw9rc0hhHz8nsWw7ecZUzp6L4z0txqAfOKq'
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, CHmzyYZA9cgfj3YyRnpXSfYR0bSLRZpZVYv8N6YwZVL0adnscLSd4FBRnCeCtG5BHclVDrGYefh3Kmjs2TERgJrj9B.csHigh entropy of concatenated method names: 'rUrlRFJz30faaab11oHTcakzf5AIlJdvsmXpLNAUhNCIpj0vPL', '_8hd0AxtuVa5N2QkSm7QRnsJdB51FrU0vcMRFKUDo9WQXXILK7O', 'XBaKvfuhxf76waGiEaqVXUATUA9TQ1dWbrqvAziNcgckLtgaZr', 'BFGLVzxnfZ4HfjHCawIZXfjDVgtdEfbRuroXUwWofu8amEHaip'
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, mq9QcI7Xrgyz6KYxjx.csHigh entropy of concatenated method names: '_0H7VvUXRvMWg0DHxIG', 'OM7SKlNTOw3pkAzvAQ', 'wh70CxnZQPOCA2ikeM', 'IsbCa5BKwb', 'hdgz22yvVV', 'lwLuif6JI8', '_5SvhFn9TZk', 'VfN0LfoPyz', 'Te736jdmOz', 'jKCT6aH1EM'
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, 1DBeL0fJpz6ESB4fPHYA2Ng4YyI86sB5IboGlaYNrhW4CF1qIIrjEfr5XX.csHigh entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'N7aoDED4EiUmgKudyh5Ppat1FUeMJeP7En0aaumz6QMnClgs7y', '_7XXNVYII33E3Sc8FXzSVNqCJaoKwSS1sI88VRz7HWmhKL2thxK', '_0gIjTVKW9PapISJ6Mcdunyvx1GWpWfW7oZgkAfUDfy5ppa9QfD', 'bR5XLA4JRmRJiqfDq16efkahVAfv2phuK30XIZe52h1ilMpkpX'
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, j9Qok6fMJKSSZIinblf0yiUbFfVLHiJ5.csHigh entropy of concatenated method names: '_4Mla20W5B3utOFq8wuF6bgcAchZ2xNCs', 'R1ToEvIz6LMc4OiM9fNQKsbasBE6krOR', 'v9JcPLx2L4e0D9qAxD9OnibJaKq9qrgV', 'Sa2v1gbxX1GaiS54V5dqG2ZZPQ4eVjue', 'JZr1pr3KJDNJR6vnJgJJe4TcbYvvzQZe', 'qwLnweIXdy1pcGusaAlbwT2mUWIssJPW', 'MLf08p4c2kK6kz9UnpWtIm7XlXuMPzpb', 'RoPTiV1OVVcVA3AjffCnDblDgeDLm1kK', 'nfBlWdXEs9wuYCYgGBFokN4uZJd8okXq', 'ctFuKyz5Ac9BzoYnUMbmEepdHXcSQtfw'
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, HcQ4iO03N6fzcmrZoUVrBKnFoxaK0bsa.csHigh entropy of concatenated method names: '_98dAAosE3lMGVdoQcEp6QvyJrEo6HF6Q', 'b38mr22MXZlWBlYDPyw4h0aKijYF4Oez', 'Q9GybaqbZino5Z8xkNmYx6olwxjWjk2P', 'gl7kLE9vYQy3Qu4ocJnTGEoEI1kfqADU', 'Q3dFUblFrIIH7YGqx41edXckc0vWeqHAwpOkPDgX1neYOEhJsoYgquxUKiDC3SpXw09', 'KB8P1HrdbVPUkIV2E4L40i0sTjRSOVR3hXuXOyQKj5Cr4UY0rp0ePJInbnl8v7Se7TN', 'qFTsKUu4ttzg2KqXKJhhy7pRwAzufis752ZP91obuFLf11usFGK9mwZmh1zeJxVxx2t', 'TaXbbHEh7LS78WACgSSS8sQmiwCOBJQDYXc4HLRMroVSWi8yYcdFROJoTfBJBSI7OoV', 'jL0vPZkvxb94VfkRs4LCEQyHw7YuDjcQUlAJt0ixJrbKhbxLG6tOGTX8noZIJHHO7xM', '_0QuDN68C20pjju21nyoI8bMgvf7gm3dMU1cnSxeUmYk6w2qluxVor2oAMJOuk3hyE0Y'
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, F4RGvMuj4U5T65cao0T2zsRWeZG2uQx8.csHigh entropy of concatenated method names: '_9bjyqOOdTM9fxFh8BtwbGN6SaBXG8CRN', 'gOIGZopd4222ZUGeO1kt9Nq94tVALXP1', 'Kg4wpSabxBU3kQYn68wDwgaZJLOL31bB', 'IZ525wro1Ygb4SdwLGXqdvJVz3APLDki', '_9tdX2eX1NxpTUXQfMcQT3Y4ohPsI3lC4', 'mXd28UpiMMoSXFz6mB2yNLT2CYiHKamu', 'A5mxzzWegS5TetGmJIJ4xZ2rDvLnHyu5', 'wqVngGpOOwusRvaagnCtB8OXUwqx2FzD', 'nQ68vI1LDSEZn12giYTc7pMYiVpKOl2E', 'r7Sw74RAvPmHwRla40j7oR7kwGdNKGUq'
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, QlwDLKHYlKx9EEtkonPHg1imYaaW6fCcivuPaRopEADljRsnbH1wJD2HPAeuPSbEDga9JRFZWxCop2RAaVPBHW1i77.csHigh entropy of concatenated method names: 'ZkJhHAMlE7UCkf5ASTYdrJLYx3QU79rxsVnsdV7qveTZj0zIC4C2JUlGR6IpW3d7ti7z43oRUKSCpVyRUFB1phQY7Z', '_4KGy0Ik8eibG4gBt6hHAK2zxd5DsOsfYAQkVaELHfl8fs2MU4QDxeh7aULHVcTOhjgQE1G14ND2QiEaZRdI4LYR754', 'Mz6E2EJcoCkC6THM2FWqaK7RoDUXKPDxWzIaLQLwuNyVEanECrU6lFfwK6MLD1gZMILoiX3Ih0ddK7S2NB2sJtuBU8', 'xdPOGJK3MKzVhq7uZfYNQoA9gA1udWcXNNxNmMvAoLEgYRxIEZgG3jW8RkQkI9yrb48OGzeKCxNy8CCQkYgd0Kp8ka', '_1cquv1UB1CC4GrjhiNm8DFGbS6k4hs10FeiEIln0SjQmF7R4AH', 'OYsTYRAytPyjm1EEJWMRmNHAVtwwx05y8m0h9QNNDgODnFN8gS', 'jTymyHwgvOGLO4S7CAbc8sdmK5QppbXw4fA3bkgPx6ZQSjFnr2', 'tEeV2TU6vuEAsTtpNknuUgBrFcKmoNNuabnodtpvX050ea9SMu', 'M6Cc8bKRn0MTr75tSd5vNkUfYhFsaVoZkTdDGFIBSvY5lIKtYu', '_8c8kFDfUZuMpKJHZv4jVExqQv16BsUtdHIWlEksTZs0herIi50'
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, KlMwnJsf8rnNpyquaW4QP4CMY3IDCj7V.csHigh entropy of concatenated method names: 's4CtUhSiaAb00xzAeHKf42A5876fK3Xm', 'QqNECHJmENMfsMNo69XccDF7P7OrC20tCjfVuycdRQUbc11QU00GhuMxXhZfDzTo0rY', 'af69LaoQC8iyzqwgFNtqAwK0BgyFpBwZaLq8plMQC4SihZ7ynndnPaUtw3mYDFkXENZ', 'vcndamzxlyNh7YuNCqD6Qskdj2pE9paLACgYT2CJ6QTGkqunNJ9onH1pTdTZ7bmtVS3', 'VGQk7AbzX5HD8d27cYnrpYdqGM965jvSpY0Dx0gROODVDqrM2XLxOyGq7JfdV7cZ0Os'
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, FXGyLuigTPD9Vpab9VsegLmV1pqpKqi7.csHigh entropy of concatenated method names: 't7Npip0kkDyIHLltHjjCaSAVh2smYBe3', '_4J6C0r6YC64Bepxb62OhJb3hIwlizPSN', 'jocDZ0vjxk41iKLQWGWhYCvWpPsew1Zc', 'drqv7umSGBLcs4yTG3OZR0XaGhoFedXO', 'gQdHEEM3vaLurBL9x7ZWh6QA3SUfWRqJ', 'FcTzsZ5zJMCjeWpFG4YnlWL8jUGWigfV', 'KX27SV4GYK72mAmA1sOSIudMrcU2bNO0', 'I5P8HwZjsYTLRqnJlPcTNVfSSmnTM1Bn', 'bkOyM3HyR8PhrlQx2NwVlIrZigTuxMg3', 'JQeUvoyWRXiNTqWuEe'
            Source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, dLiNKQaU0GLrnqDgfn9MKAjxEXAjUsCS5VFq7cg58lAoMo8IL0VaN74ez99xHY9Zksv9JRhkiG8BEwAEmtxuRjh1Yh.csHigh entropy of concatenated method names: 'TPYkdhHGwocoMsz560DR5iBMimTJMZdDD3u7a2nIWImThorDJAz4eqBkP7o9dPJTTfbzRxYitnokQJYcZJzZ7DC4Ah', 'GOCsIRC8Q4nxPKHXqlVYZ5dgfivBjQwCe2Kxxdb8IFeOZAtBw364Cv03TkkEffBaNiLarfjxK5whdiy0HE5su59oyk', '_56lKky7HKCiGvvufLeLrKkEFDX4TPeWABW9r7jwwm0C1Pajo9Jm4Z4RcseGY3CFS4Mf6ZD5opEPnAiRNzH12C06bLK', 'bHNyZdkKwRBJNfktdK6VQIb1NuLQoBtcPKZ6tGFucTfTKKm4jqov3mM6W5QJdsC5ZRzpuMduWjqrUpm9P0BBKR741K', 'VLPbdb734DEXFNzNMJgx6QTgA9iwBbyHmvxKyR2MZ0fj4LQvc0zGEPnoe3FIoGbdSfgL0ZqgqkenwCMQ8vr56sefvF', 'BkjLwdSRbbwL5qFgri1oUPFmhQNu9LHADxdc9c6okthNuVy7NZmLKDy0MNxGGB3U7GzNvVebpTCiykI7OawXjMDoER', '_01tZF8RV3h2rgfFjOtKvdXMif2JYt3xkKWHALfjwQKPPUYCmy3bUdFqbzhoi6LLc4YFPxCzeRreuCcNufLIcO6oUIV', '_6XhquSQL9HdoiTuxn16vZj4k0LJKyvlW4Xa10scaf6nNxRSnQ134buuPaVKX3DJnFfoSB7x5aPmh24pxUuR8Lm5AAN', 'E121lUQURp7GbT22eMW3SM98xRasZLYYQTClmUPUd5ZtEcwVp1mbXWd3J99hO7FvZEDSpjochsgOJxarZW14XBML4S', 'f3astxXuqIbWxUwsg1qNdIHO6iQLxwNasUpnluE6W5SV450uJrakPhGsw9rc0hhHz8nsWw7ecZUzp6L4z0txqAfOKq'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, yvU5BoedaOUElFudGN.csHigh entropy of concatenated method names: 'YIVtJPp5wI', 'e8JtIpWV9Z', 'Y82tuHu1mQ', 'BlntL8htQN', 'NPLtWTUdn4', 'jfVtCbIkS0', 'VkLtwdgQpq', 'jdhtaHFiuw', 'XKFt4kyKVZ', 'R71t5iS00P'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, ybhaVjKNYJ6Rw52lMZ.csHigh entropy of concatenated method names: 'tweNbay1kr', 'n6yN7Y4YVG', 'yT9NTwus4n', 'svvNfZawTW', 'wMENDxntqr', 'ekNNZmCe6s', 'qyYNk96MAf', 'xnYNx6I6MP', 'mNiNeAqxjs', 'wWHNcBRqfp'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, Aofa48Ap17SCL4oU8no.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'NqCjN7kySH', 'VPKjr0oKc8', 'U84jFm3lfb', 'FUkjjg30pA', 'OBPjnL2324', 'syjjotwjAO', 'cmMjvWCLcG'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, j5mVEnRX2x3G3VRvF9.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'yZWUKbbBqM', 'gdUU6jGiCP', 'ggqUz5Zn2m', 'YRpqH0NVP7', 'INaqAHrBZH', 'eLmqUCgZw1', 'JQ8qqOJiMV', 'jDMDIlXrKnFShqfKmBm'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, GAqQ6XasuiYgyyyAGh.csHigh entropy of concatenated method names: 'B7sGShAGHO', 'FuSGM9bxPa', 'lVbG1GkUci', 'aZrG2oURm9', 'QHjG3mQIej', 'bQCGXYc0lN', 'kAdGdgQ89P', 'wZEGO7ZkK0', 'DbSGK1dr8h', 'N4LG6ld5xJ'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, swAlCG4YEdkcIZYAHq.csHigh entropy of concatenated method names: 'V7aRLCKfXG', 'fIWRCJ7rVV', 'QSTRa6P9V3', 'YQ0R427jN9', 'KpYREoyfl5', 'lVFR0cdTaG', 'OPERYjKPoC', 'uq4RsypWFZ', 'r30RNncRmm', 'GefRrkhO6x'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, xU18Cf1QefILmkxlKb.csHigh entropy of concatenated method names: 'ToString', 'kJU0l4qg3F', 'H1607Kq45P', 'Y1H0TYl6wN', 'ewE0ffVMgH', 'GIw0DaxOoC', 'cR70Zra5Kb', 'Oh00kj0AdG', 'bCq0xXBIq2', 'Fvw0eK0H4k'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, gxcJaF9hDRF2Cccoeq.csHigh entropy of concatenated method names: 'G5NyaUn7w8', 'DmUy4e1GY5', 'XLpybu9UY9', 'eKLy7JLNwk', 'WpQyfa0RLn', 'xsRyDXSbQO', 'D43ykiOobH', 'HhdyxKcoJS', 'OnBycD0uZX', 'zw2ylPQQay'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, HveiEyzlmFcmRqcgS5.csHigh entropy of concatenated method names: 'tvyrCjSKVq', 'Khhrax0cm5', 'TxIr4lQiYE', 'jyDrbl3V6Z', 'asir7jaNJV', 'QB6rfUHUFt', 'ux2rDDSYJF', 'qVGrvqCy2x', 'HparJRWpQr', 'ED1rITul12'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, BOu9a8UjtfZ0aZNvB5.csHigh entropy of concatenated method names: 'bFkuFeLFe', 'b7WLblJ8v', 'UUmCRpbG9', 'MXcwwvWWM', 'gnn4BWIL4', 'fdV5ZQMLs', 'A1lery0pCrr0jW36OY', 'hKkZN9J3wI42VXlPNF', 'QeusfhagW', 'YX1rG8N3E'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, hKVVgIkOptSme0OT77.csHigh entropy of concatenated method names: 'RmUtVJ3iXp', 'nnptRDriZJ', 'hF7tQvR3MD', 'VgCQ62Rxng', 'DIWQzEgdKW', 'ilItHJyWdm', 'kX3tA3vwke', 'wgUtUaNtIT', 'Hhctqc4RZP', 'zK6tpyTdjG'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, wnhOOHAALJ2IHClqNsU.csHigh entropy of concatenated method names: 'cB5r6GjDbg', 'yDhrzqWy42', 'E8AFHmUSkX', 'JSgFAhCAKh', 's4jFULIfpw', 'XJ5Fqma54j', 'LmxFpol20G', 'DupFhrSd4P', 'IZEFVoVUF1', 'i2RFG5QwpC'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, cFd7NwAqkM4Di55K07N.csHigh entropy of concatenated method names: 'lSHF6VWXhi', 'e60FzWYLaG', 'rRwjHdag7r', 'l1yCOrr3FoctcSqTid7', 'gGSE0PrN4enJlXoA6E2', 'MZuheOrQCUjfr9hBUoV', 'WUJ0W6ry0BFYPNS7TtT', 'BDmvZZrfFoGqqrQGlug', 'BpOREBrerUodxFeQhta'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, Ofsjm25G0qFlbZu6tX.csHigh entropy of concatenated method names: 'grfmWXwUkM', 'EhMmwE2n2n', 't8aRTbxxf5', 'CMYRfc0Vmp', 'aDPRDDSWDD', 'wTsRZ68bKw', 'qnORkmGRd9', 'MiLRxXRCut', 'pwrReE39hB', 'XnmRcKs73X'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, CGvFU5GSNkmbypFrIp.csHigh entropy of concatenated method names: 'Dispose', 'yQQAKE1Kbl', 'BFHU7mjbL4', 'UM8j3Ym8ZA', 'DCFA6rmtmb', 'BxLAzc3Nmt', 'ProcessDialogKey', 'GoIUHbhaVj', 'rYJUA6Rw52', 'OMZUUtnrTg'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, youlhSpBihKp5txDLV.csHigh entropy of concatenated method names: 'vx7AtAqQ6X', 'ruiABYgyyy', 'gYEA8dkcIZ', 'qAHAPqlfsj', 'Ku6AEtXusg', 'ukGA0TGqRQ', 'l2Nr5DCipDwPFGSwDY', 'v9p9fq6bUrCpLlPkRB', 'XYmAAdlGae', 'NiJAq1pFCR'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, ohJprSAHdUFmktERHwi.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'lAWrlbHYj5', 'X7priT4sHm', 'ygKr9L8veq', 'eNhrS17C4A', 'n5yrMPsFKG', 'Yfyr1uMMMK', 'mx1r2eOQkQ'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, DjSA5EdCOIQQE1Kbla.csHigh entropy of concatenated method names: 'mAmNEUDdBi', 'Im8NY0sYEP', 'lo1NNq7SJf', 'LFoNFqqVad', 'L6NNnFJ2M6', 'PdVNvYY6sO', 'Dispose', 'i9JsVwCTem', 'PVWsGUcwmt', 'P2IsR8YmGG'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, zsgjkGbTGqRQsPVDRf.csHigh entropy of concatenated method names: 'L7mQhgEht6', 'CQZQGn3Sui', 'a2kQm9grWI', 'xWpQthlAbK', 'IstQBFKCUD', 'mwXm31tYbK', 'mFDmXdSkbO', 'xivmdZCEOw', 'PsOmOxJKMW', 'R7UmKp7RWe'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, jnrTgk6CXB6CSrtxBc.csHigh entropy of concatenated method names: 'V2UrRivSIk', 'UKyrmLpadX', 'EmtrQoKSm4', 'WBnrt5VP8y', 'VAtrNRWvi4', 'L3VrBlqNgh', 'Next', 'Next', 'Next', 'NextBytes'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, NlnXXwXaUFwFiD76SW.csHigh entropy of concatenated method names: 'hgoYOFvL8U', 'XGSY68TNve', 'uHDsHg8B4T', 'WpBsAHkgda', 'fJVYlugsqL', 'uc5YiFAaWI', 'QA1Y9aSoSM', 'NJbYSiJa5Z', 'KH6YMc224i', 'PmMY1i6Umy'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, utR61RBcBegxYFsMxm.csHigh entropy of concatenated method names: 'LcsqhTXNrw', 'R5jqVcDxgH', 'POBqG1bDfU', 'MgdqRPCuQi', 'l4ZqmGUVY6', 'yb0qQO0NDl', 'eWPqtXS7Ci', 'A9SqBM2rEq', 'mffqgNn3Hd', 'jRjq8JHFoQ'
            Source: 0.2.7I7TOCVsCr.exe.419f160.5.raw.unpack, nxn0n12nXpx7fWu3rG.csHigh entropy of concatenated method names: 'YU8Y8wWuDr', 'sGaYP7XCOV', 'ToString', 'v5HYVKemP6', 'hvYYGMxBgK', 'kljYRkCbmV', 'bvLYmWYlr4', 'LdXYQnaNUc', 'xKgYtyFjro', 'z20YBtMKB4'
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeFile created: C:\Users\user\AppData\Roaming\MicroSoftOutlook.exeJump to dropped file
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicroSoftOutlook.lnkJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicroSoftOutlook.lnkJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Yara detected AntiVM3
            Source: Yara matchFile source: Process Memory Space: 7I7TOCVsCr.exe PID: 2672, type: MEMORYSTR
            Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMemory allocated: 15B0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMemory allocated: 2FA0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMemory allocated: 2EF0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMemory allocated: 8F00000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMemory allocated: 9F00000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMemory allocated: A100000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMemory allocated: B100000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMemory allocated: 1160000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMemory allocated: 2D10000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMemory allocated: 2C30000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeWindow / User API: threadDelayed 6116Jump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeWindow / User API: threadDelayed 3705Jump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exe TID: 5848Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exe TID: 7032Thread sleep time: -39660499758475511s >= -30000sJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: Amcache.hve.14.drBinary or memory string: VMware
            Source: Amcache.hve.14.drBinary or memory string: VMware Virtual USB Mouse
            Source: Amcache.hve.14.drBinary or memory string: vmci.syshbin
            Source: Amcache.hve.14.drBinary or memory string: VMware, Inc.
            Source: Amcache.hve.14.drBinary or memory string: VMware20,1hbin@
            Source: Amcache.hve.14.drBinary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
            Source: Amcache.hve.14.drBinary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
            Source: Amcache.hve.14.drBinary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
            Source: Amcache.hve.14.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
            Source: Amcache.hve.14.drBinary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
            Source: Amcache.hve.14.drBinary or memory string: c:/windows/system32/drivers/vmci.sys
            Source: Amcache.hve.14.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
            Source: Amcache.hve.14.drBinary or memory string: vmci.sys
            Source: Amcache.hve.14.drBinary or memory string: vmci.syshbin`
            Source: Amcache.hve.14.drBinary or memory string: \driver\vmci,\driver\pci
            Source: Amcache.hve.14.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
            Source: Amcache.hve.14.drBinary or memory string: VMware20,1
            Source: Amcache.hve.14.drBinary or memory string: Microsoft Hyper-V Generation Counter
            Source: Amcache.hve.14.drBinary or memory string: NECVMWar VMware SATA CD00
            Source: Amcache.hve.14.drBinary or memory string: VMware Virtual disk SCSI Disk Device
            Source: Amcache.hve.14.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
            Source: Amcache.hve.14.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
            Source: Amcache.hve.14.drBinary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
            Source: Amcache.hve.14.drBinary or memory string: VMware PCI VMCI Bus Device
            Source: Amcache.hve.14.drBinary or memory string: VMware VMCI Bus Device
            Source: Amcache.hve.14.drBinary or memory string: VMware Virtual RAM
            Source: Amcache.hve.14.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
            Source: Amcache.hve.14.drBinary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
            Source: 7I7TOCVsCr.exe, 00000001.00000002.2307247292.0000000000F36000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll*l
            Source: Amcache.hve.14.drBinary or memory string: vmci.inf_amd64_68ed49469341f563
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess queried: DebugPortJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMemory allocated: page read and write | page guardJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Injects a PE file into a foreign processes
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeMemory written: C:\Users\user\Desktop\7I7TOCVsCr.exe base: 400000 value starts with: 4D5AJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeProcess created: C:\Users\user\Desktop\7I7TOCVsCr.exe "C:\Users\user\Desktop\7I7TOCVsCr.exe"Jump to behavior
            Source: 7I7TOCVsCr.exe, 00000001.00000002.2309107475.00000000031C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: q'PING!<Xwormmm>Program Manager<Xwormmm>0
            Source: 7I7TOCVsCr.exe, 00000001.00000002.2309107475.00000000031C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: q'PING!<Xwormmm>Program Manager<Xwormmm>0Te
            Source: 7I7TOCVsCr.exe, 00000001.00000002.2309107475.00000000031C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
            Source: 7I7TOCVsCr.exe, 00000001.00000002.2309107475.00000000031C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
            Source: 7I7TOCVsCr.exe, 00000001.00000002.2309107475.00000000031C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Managert-
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeQueries volume information: C:\Users\user\Desktop\7I7TOCVsCr.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeQueries volume information: C:\Users\user\Desktop\7I7TOCVsCr.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
            Source: 7I7TOCVsCr.exe, 00000001.00000002.2313026771.00000000067A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ender\MsMpeng.exe
            Source: Amcache.hve.14.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
            Source: Amcache.hve.LOG1.14.dr, Amcache.hve.14.drBinary or memory string: msmpeng.exe
            Source: Amcache.hve.14.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
            Source: Amcache.hve.LOG1.14.dr, Amcache.hve.14.drBinary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
            Source: Amcache.hve.LOG1.14.dr, Amcache.hve.14.drBinary or memory string: MsMpEng.exe
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
            Source: C:\Users\user\Desktop\7I7TOCVsCr.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

            Stealing of Sensitive Information

            barindex
            Yara detected XWorm
            Source: Yara matchFile source: 0.2.7I7TOCVsCr.exe.300544c.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.7I7TOCVsCr.exe.2faadfc.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.7I7TOCVsCr.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000000.00000002.875429439.0000000003019000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2306935663.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2309107475.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 7I7TOCVsCr.exe PID: 2672, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: 7I7TOCVsCr.exe PID: 5296, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Yara detected XWorm
            Source: Yara matchFile source: 0.2.7I7TOCVsCr.exe.300544c.2.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.7I7TOCVsCr.exe.2faadfc.3.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.7I7TOCVsCr.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.7I7TOCVsCr.exe.300544c.2.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.7I7TOCVsCr.exe.2faadfc.3.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000000.00000002.875429439.0000000003019000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2306935663.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2309107475.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.875429439.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 7I7TOCVsCr.exe PID: 2672, type: MEMORYSTR
            Source: Yara matchFile source: Process Memory Space: 7I7TOCVsCr.exe PID: 5296, type: MEMORYSTR

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
            Windows Management Instrumentation            		2
            Registry Run Keys / Startup Folder            		112
            Process Injection            		1
            Masquerading            		OS Credential Dumping231
            Security Software Discovery            		Remote Services11
            Archive Collected Data            		1
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/Job1
            DLL Side-Loading            		2
            Registry Run Keys / Startup Folder            		1
            Disable or Modify Tools            		LSASS Memory2
            Process Discovery            		Remote Desktop ProtocolData from Removable Media1
            Non-Standard Port            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		141
            Virtualization/Sandbox Evasion            		Security Account Manager141
            Virtualization/Sandbox Evasion            		SMB/Windows Admin SharesData from Network Shared Drive1
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook112
            Process Injection            		NTDS1
            Application Window Discovery            		Distributed Component Object ModelInput Capture11
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Deobfuscate/Decode Files or Information            		LSA Secrets1
            File and Directory Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts3
            Obfuscated Files or Information            		Cached Domain Credentials13
            System Information Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items22
            Software Packing            		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            Timestomp            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
            DLL Side-Loading            		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.