Malware analysis https://gofile.io/d/FkJq3p Malicious activity

Add for printing

URL:	https://gofile.io/d/FkJq3p
Full analysis:	https://app.any.run/tasks/fde9618f-1f26-42c8-8860-9dc949266f58
Verdict:	Malicious activity
Threats:	Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	April 24, 2025, 01:17:37
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	fileshare evasion github waspstealer stealer arch-scr nodejs
Indicators:
MD5:	D30ADD0C6C49D374D07B18AC8F717801
SHA1:	3C6A9EC0EDC3E5F9D75708F817CA1C35FA95BF16
SHA256:	369610A96DD02B90290766055128D34B165C5C6D3F75ECEDDDD7468747F84CAC
SSDEEP:	3:N8rxL1yvPV:2Zqt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- WASPSTEALER has been detected (SURICATA)
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 7688)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 5776)
  - ZokaSetup_App.exe (PID: 11196)
- Stealers network behavior
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 11196)
- Changes powershell execution policy (Bypass)
  - cmd.exe (PID: 7156)
  - cmd.exe (PID: 10652)
- Bypass execution policy to execute commands
  - powershell.exe (PID: 920)
  - powershell.exe (PID: 12740)
- Steals credentials from Web Browsers
  - ZokaSetup_App.exe (PID: 5776)
- Actions looks like stealing of personal data
  - chrome.exe (PID: 896)
  - msedge.exe (PID: 9912)
  - ZokaSetup_App.exe (PID: 5776)
- Changes the login/logoff helper path in the registry
  - reg.exe (PID: 8140)
- Uses Task Scheduler to autorun other applications
  - cmd.exe (PID: 10152)
- Create files in the Startup directory
  - ZokaSetup_App.exe (PID: 5776)
- Disables task manager
  - reg.exe (PID: 12896)
- Changes the autorun value in the registry
  - reg.exe (PID: 14216)
  - reg.exe (PID: 8900)
SUSPICIOUS
- Executes as Windows Service
  - VSSVC.exe (PID: 6032)
- Process drops legitimate windows executable
  - msiexec.exe (PID: 8116)
- Reads the Windows owner or organization settings
  - msiexec.exe (PID: 8116)
- Starts CMD.EXE for commands execution
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 7688)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 5776)
  - cmd.exe (PID: 9048)
  - ZokaSetup_App.exe (PID: 11196)
- Starts POWERSHELL.EXE for commands execution
  - cmd.exe (PID: 7812)
  - cmd.exe (PID: 7788)
  - cmd.exe (PID: 5608)
  - cmd.exe (PID: 7608)
  - cmd.exe (PID: 872)
  - cmd.exe (PID: 3332)
  - cmd.exe (PID: 7540)
  - cmd.exe (PID: 7620)
  - cmd.exe (PID: 5772)
  - cmd.exe (PID: 6652)
  - cmd.exe (PID: 3032)
  - cmd.exe (PID: 5188)
  - cmd.exe (PID: 7980)
  - cmd.exe (PID: 1760)
  - cmd.exe (PID: 7540)
  - cmd.exe (PID: 4932)
  - cmd.exe (PID: 7616)
  - cmd.exe (PID: 5772)
  - cmd.exe (PID: 2596)
  - cmd.exe (PID: 6816)
  - cmd.exe (PID: 6632)
  - cmd.exe (PID: 2432)
  - cmd.exe (PID: 7588)
  - cmd.exe (PID: 6344)
  - cmd.exe (PID: 4056)
  - cmd.exe (PID: 6652)
  - cmd.exe (PID: 7700)
  - cmd.exe (PID: 7888)
  - cmd.exe (PID: 4884)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 7968)
  - cmd.exe (PID: 864)
  - cmd.exe (PID: 7808)
  - cmd.exe (PID: 7148)
  - cmd.exe (PID: 8024)
  - cmd.exe (PID: 7156)
  - cmd.exe (PID: 7552)
  - cmd.exe (PID: 12412)
  - cmd.exe (PID: 10652)
  - cmd.exe (PID: 11188)
  - cmd.exe (PID: 9028)
  - cmd.exe (PID: 11824)
  - cmd.exe (PID: 13764)
  - cmd.exe (PID: 4932)
  - cmd.exe (PID: 16096)
  - cmd.exe (PID: 10992)
  - cmd.exe (PID: 15208)
  - cmd.exe (PID: 15024)
  - cmd.exe (PID: 11308)
  - cmd.exe (PID: 14496)
  - cmd.exe (PID: 10532)
  - cmd.exe (PID: 15324)
  - cmd.exe (PID: 6980)
  - cmd.exe (PID: 4620)
  - cmd.exe (PID: 2420)
  - cmd.exe (PID: 11192)
  - cmd.exe (PID: 4756)
  - cmd.exe (PID: 6564)
  - cmd.exe (PID: 12220)
  - cmd.exe (PID: 13868)
  - cmd.exe (PID: 7672)
  - cmd.exe (PID: 2368)
  - cmd.exe (PID: 10144)
  - cmd.exe (PID: 9268)
  - cmd.exe (PID: 10368)
- Application launched itself
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 7688)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 5776)
  - cmd.exe (PID: 9048)
  - ZokaSetup_App.exe (PID: 11196)
- The process checks if it is being run in the virtual environment
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 7688)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 5776)
  - ZokaSetup_App.exe (PID: 11196)
- Checks for external IP
  - svchost.exe (PID: 2196)
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 7688)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 5776)
  - ZokaSetup_App.exe (PID: 11196)
- Uses TASKKILL.EXE to kill process
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 11196)
- Get information on the list of running processes
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 7688)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 5776)
  - cmd.exe (PID: 5972)
  - ZokaSetup_App.exe (PID: 11196)
- Starts NET.EXE to display or manage information about active sessions
  - net.exe (PID: 7712)
  - cmd.exe (PID: 6736)
  - net.exe (PID: 7268)
  - cmd.exe (PID: 7716)
  - cmd.exe (PID: 7724)
  - net.exe (PID: 5228)
  - cmd.exe (PID: 5244)
  - net.exe (PID: 6612)
  - cmd.exe (PID: 9480)
  - net.exe (PID: 1204)
- Uses WMIC.EXE to obtain data on processes
  - cmd.exe (PID: 5588)
  - cmd.exe (PID: 2780)
  - cmd.exe (PID: 8024)
  - cmd.exe (PID: 8180)
  - cmd.exe (PID: 9356)
- Starts process via Powershell
  - powershell.exe (PID: 2104)
  - powershell.exe (PID: 5384)
  - powershell.exe (PID: 9596)
- Uses REG/REGEDIT.EXE to modify registry
  - cmd.exe (PID: 3240)
  - cmd.exe (PID: 7748)
  - cmd.exe (PID: 7520)
  - cmd.exe (PID: 12044)
  - cmd.exe (PID: 7404)
  - cmd.exe (PID: 14220)
  - cmd.exe (PID: 16380)
  - cmd.exe (PID: 14676)
- Searches for installed software
  - reg.exe (PID: 7792)
  - reg.exe (PID: 7532)
  - reg.exe (PID: 240)
  - reg.exe (PID: 5576)
  - reg.exe (PID: 7872)
  - reg.exe (PID: 4868)
  - reg.exe (PID: 5380)
  - reg.exe (PID: 1804)
  - reg.exe (PID: 5680)
  - reg.exe (PID: 5364)
  - reg.exe (PID: 7808)
  - reg.exe (PID: 7888)
  - reg.exe (PID: 7748)
  - reg.exe (PID: 7084)
  - reg.exe (PID: 7748)
  - reg.exe (PID: 5200)
  - reg.exe (PID: 5596)
  - reg.exe (PID: 8184)
  - reg.exe (PID: 8184)
  - reg.exe (PID: 5680)
  - reg.exe (PID: 7588)
  - reg.exe (PID: 8172)
  - reg.exe (PID: 3768)
  - reg.exe (PID: 5680)
  - reg.exe (PID: 4452)
  - reg.exe (PID: 7084)
  - reg.exe (PID: 7748)
  - reg.exe (PID: 7532)
  - reg.exe (PID: 668)
  - reg.exe (PID: 7740)
  - reg.exe (PID: 6324)
  - reg.exe (PID: 4068)
  - reg.exe (PID: 1748)
  - reg.exe (PID: 6252)
  - reg.exe (PID: 7208)
  - reg.exe (PID: 7364)
  - reg.exe (PID: 4464)
  - reg.exe (PID: 7820)
  - reg.exe (PID: 540)
  - reg.exe (PID: 5972)
  - reg.exe (PID: 3784)
  - reg.exe (PID: 6272)
  - reg.exe (PID: 7868)
  - reg.exe (PID: 6892)
  - reg.exe (PID: 7928)
  - reg.exe (PID: 2096)
  - reg.exe (PID: 444)
  - reg.exe (PID: 8120)
  - reg.exe (PID: 7172)
  - reg.exe (PID: 7156)
  - reg.exe (PID: 6820)
  - reg.exe (PID: 5084)
  - reg.exe (PID: 7440)
  - reg.exe (PID: 7728)
  - reg.exe (PID: 4724)
  - reg.exe (PID: 8180)
  - reg.exe (PID: 8172)
  - reg.exe (PID: 6028)
  - reg.exe (PID: 8068)
  - reg.exe (PID: 2140)
  - reg.exe (PID: 2136)
  - reg.exe (PID: 4268)
  - reg.exe (PID: 1180)
  - reg.exe (PID: 7236)
  - reg.exe (PID: 7856)
  - reg.exe (PID: 7556)
  - reg.exe (PID: 7936)
  - reg.exe (PID: 7992)
  - reg.exe (PID: 4012)
  - reg.exe (PID: 7568)
  - reg.exe (PID: 5172)
  - reg.exe (PID: 6892)
  - reg.exe (PID: 7208)
  - reg.exe (PID: 2664)
  - reg.exe (PID: 5048)
  - reg.exe (PID: 6740)
  - reg.exe (PID: 2552)
  - reg.exe (PID: 7240)
  - reg.exe (PID: 7820)
  - reg.exe (PID: 7492)
  - reg.exe (PID: 6036)
  - reg.exe (PID: 10120)
  - reg.exe (PID: 14440)
  - reg.exe (PID: 14780)
  - reg.exe (PID: 10584)
  - reg.exe (PID: 14972)
  - reg.exe (PID: 7280)
  - reg.exe (PID: 9260)
  - reg.exe (PID: 15292)
  - reg.exe (PID: 12004)
  - reg.exe (PID: 9116)
  - reg.exe (PID: 8788)
  - reg.exe (PID: 8800)
  - reg.exe (PID: 7376)
  - reg.exe (PID: 15164)
  - reg.exe (PID: 13940)
- The process executes Powershell scripts
  - cmd.exe (PID: 7156)
  - cmd.exe (PID: 10652)
- The process bypasses the loading of PowerShell profile settings
  - cmd.exe (PID: 7156)
- Uses NETSH.EXE to obtain data on the network
  - cmd.exe (PID: 8056)
- Starts SC.EXE for service management
  - cmd.exe (PID: 16272)
  - cmd.exe (PID: 10984)
- Restarts service on failure
  - sc.exe (PID: 12820)
- Creates a new Windows service
  - sc.exe (PID: 6980)
- The process executes VB scripts
  - cmd.exe (PID: 11820)
- Reads security settings of Internet Explorer
  - ZokaSetup_App.exe (PID: 14688)
INFO
- Checks supported languages
  - identity_helper.exe (PID: 6572)
  - msiexec.exe (PID: 8116)
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 7688)
  - ZokaSetup_App.exe (PID: 4208)
  - ZokaSetup_App.exe (PID: 6324)
  - ZokaSetup_App.exe (PID: 7976)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 6676)
  - ZokaSetup_App.exe (PID: 6760)
  - ZokaSetup_App.exe (PID: 5776)
  - ZokaSetup_App.exe (PID: 5500)
  - identity_helper.exe (PID: 6392)
  - ZokaSetup_App.exe (PID: 5936)
  - ZokaSetup_App.exe (PID: 7604)
  - chrome.exe (PID: 896)
  - msedge.exe (PID: 9912)
  - ZokaSetup_App.exe (PID: 14688)
  - identity_helper.exe (PID: 10336)
  - ZokaSetup_App.exe (PID: 11196)
  - ZokaSetup_App.exe (PID: 300)
  - ZokaSetup_App.exe (PID: 8828)
- Attempting to use file storage service
  - msedge.exe (PID: 7216)
- Application launched itself
  - msedge.exe (PID: 1628)
  - msedge.exe (PID: 3900)
  - chrome.exe (PID: 896)
  - msedge.exe (PID: 9912)
  - msedge.exe (PID: 14128)
- Reads Environment values
  - identity_helper.exe (PID: 6572)
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 7688)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 5776)
  - identity_helper.exe (PID: 6392)
  - chrome.exe (PID: 896)
  - msedge.exe (PID: 9912)
  - ZokaSetup_App.exe (PID: 14688)
  - identity_helper.exe (PID: 10336)
  - ZokaSetup_App.exe (PID: 11196)
- Reads the computer name
  - identity_helper.exe (PID: 6572)
  - msiexec.exe (PID: 8116)
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 4208)
  - ZokaSetup_App.exe (PID: 6324)
  - ZokaSetup_App.exe (PID: 7688)
  - ZokaSetup_App.exe (PID: 7976)
  - ZokaSetup_App.exe (PID: 6676)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 5776)
  - ZokaSetup_App.exe (PID: 5500)
  - ZokaSetup_App.exe (PID: 6760)
  - ZokaSetup_App.exe (PID: 5936)
  - identity_helper.exe (PID: 6392)
  - ZokaSetup_App.exe (PID: 7604)
  - chrome.exe (PID: 896)
  - msedge.exe (PID: 9912)
  - ZokaSetup_App.exe (PID: 14688)
  - identity_helper.exe (PID: 10336)
  - ZokaSetup_App.exe (PID: 11196)
  - ZokaSetup_App.exe (PID: 300)
  - ZokaSetup_App.exe (PID: 8828)
- Reads Microsoft Office registry keys
  - msedge.exe (PID: 1628)
- Creates files or folders in the user directory
  - msiexec.exe (PID: 8116)
  - ZokaSetup_App.exe (PID: 7152)
  - chrome.exe (PID: 896)
  - msedge.exe (PID: 9912)
  - ZokaSetup_App.exe (PID: 5776)
  - ZokaSetup_App.exe (PID: 14688)
- Manages system restore points
  - SrTasks.exe (PID: 5084)
- Executable content was dropped or overwritten
  - msiexec.exe (PID: 8116)
- Creates a software uninstall entry
  - msiexec.exe (PID: 8116)
- The sample compiled with english language support
  - msiexec.exe (PID: 8116)
- Reads product name
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 7688)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 5776)
  - ZokaSetup_App.exe (PID: 11196)
- Checks if a key exists in the options dictionary (POWERSHELL)
  - powershell.exe (PID: 7980)
  - powershell.exe (PID: 6632)
  - powershell.exe (PID: 7516)
  - powershell.exe (PID: 4932)
  - powershell.exe (PID: 732)
  - powershell.exe (PID: 6244)
  - powershell.exe (PID: 4784)
  - powershell.exe (PID: 896)
  - powershell.exe (PID: 6384)
  - powershell.exe (PID: 6668)
  - powershell.exe (PID: 3992)
  - powershell.exe (PID: 8092)
  - powershell.exe (PID: 12812)
  - powershell.exe (PID: 16076)
  - powershell.exe (PID: 10976)
- Reads the software policy settings
  - slui.exe (PID: 4724)
  - slui.exe (PID: 4572)
  - ZokaSetup_App.exe (PID: 14688)
- Manual execution by a user
  - ZokaSetup_App.exe (PID: 7688)
  - msedge.exe (PID: 14128)
  - ZokaSetup_App.exe (PID: 11196)
- Reads CPU info
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 7688)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 5776)
  - ZokaSetup_App.exe (PID: 11196)
- Checks proxy server information
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 7688)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 5776)
  - slui.exe (PID: 4572)
  - chrome.exe (PID: 896)
  - msedge.exe (PID: 9912)
  - ZokaSetup_App.exe (PID: 11196)
- Reads the machine GUID from the registry
  - ZokaSetup_App.exe (PID: 7152)
  - ZokaSetup_App.exe (PID: 7688)
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 5776)
  - chrome.exe (PID: 896)
  - ZokaSetup_App.exe (PID: 14688)
  - ZokaSetup_App.exe (PID: 11196)
- Node.js compiler has been detected
  - ZokaSetup_App.exe (PID: 7152)
- Reads security settings of Internet Explorer
  - WMIC.exe (PID: 232)
  - WMIC.exe (PID: 7740)
  - WMIC.exe (PID: 6892)
  - WMIC.exe (PID: 4380)
  - cscript.exe (PID: 11248)
  - WMIC.exe (PID: 14752)
- The executable file from the user directory is run by the Powershell process
  - ZokaSetup_App.exe (PID: 7908)
  - ZokaSetup_App.exe (PID: 5776)
- Process checks computer location settings
  - ZokaSetup_App.exe (PID: 5776)
  - chrome.exe (PID: 896)
  - msedge.exe (PID: 9912)
- The Powershell gets current clipboard
  - powershell.exe (PID: 7776)
  - powershell.exe (PID: 12092)
  - powershell.exe (PID: 5600)
  - powershell.exe (PID: 14308)
  - powershell.exe (PID: 14476)
  - powershell.exe (PID: 15284)
  - powershell.exe (PID: 10984)
  - powershell.exe (PID: 14800)
  - powershell.exe (PID: 8496)
  - powershell.exe (PID: 4284)
  - powershell.exe (PID: 9052)
  - powershell.exe (PID: 5408)
  - powershell.exe (PID: 10268)
  - powershell.exe (PID: 8804)
  - powershell.exe (PID: 9284)
  - powershell.exe (PID: 9944)
  - powershell.exe (PID: 10900)
  - powershell.exe (PID: 15304)
- Create files in a temporary directory
  - ZokaSetup_App.exe (PID: 5776)
  - chrome.exe (PID: 896)
- Creates files in the program directory
  - ZokaSetup_App.exe (PID: 5776)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

1 613

Monitored processes

1 467

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

132

C:\WINDOWS\system32\cmd.exe /d /s /c "C:\WINDOWS\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""

C:\Windows\System32\cmd.exe

—

ZokaSetup_App.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll

208

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DigitalProductId

C:\Windows\System32\reg.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Registry Console Tool

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll

208

C:\WINDOWS\system32\cmd.exe /d /s /c "C:\WINDOWS\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""

C:\Windows\System32\cmd.exe

—

ZokaSetup_App.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll

208

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

208

C:\WINDOWS\system32\cmd.exe /d /s /c "C:\WINDOWS\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F64180271F0}""

C:\Windows\System32\cmd.exe

—

ZokaSetup_App.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll

232

wmic process where processid=7152 get ExecutablePath

C:\Windows\System32\wbem\WMIC.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

WMI Commandline Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll

232

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

232

C:\WINDOWS\system32\cmd.exe /d /s /c "C:\WINDOWS\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mstsc-4b0a31aa-df6a-4307-9b47-d5cc50009643""

C:\Windows\System32\cmd.exe

—

ZokaSetup_App.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll

232

C:\WINDOWS\system32\cmd.exe /d /s /c "C:\WINDOWS\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Professional2019Retail - es-es""

C:\Windows\System32\cmd.exe

—

ZokaSetup_App.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll

240

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

379 771

Read events

379 356

Write events

397

Delete events

Modification events


(PID) Process:	(1628) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\525034
Operation:	write	Name:	WindowTabManagerFileMappingId
Value: {03FC3B2C-4DF1-4C1B-9945-D1A902A0E6EB}
(PID) Process:	(1628) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\525034
Operation:	write	Name:	WindowTabManagerFileMappingId
Value: {0CA8C649-1C00-4900-83FD-A571E33AF186}
(PID) Process:	(1628) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\525034
Operation:	write	Name:	WindowTabManagerFileMappingId
Value: {6412B94B-3729-4744-83FE-4878BA71BB9D}
(PID) Process:	(1628) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(1628) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 2
(PID) Process:	(1628) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 1
(PID) Process:	(1628) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:	write	Name:	user_experience_metrics.stability.exited_cleanly
Value: 0
(PID) Process:	(1628) msedge.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:	write	Name:	S-1-5-21-1693682860-607145093-2874071422-1001
Value: 2C328C4412922F00
(PID) Process:	(1628) msedge.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:	write	Name:	S-1-5-21-1693682860-607145093-2874071422-1001
Value: E989944412922F00
(PID) Process:	(1628) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\525034
Operation:	write	Name:	WindowTabManagerFileMappingId
Value: {71945B90-DF6B-4781-A2C0-AA39D49BA449}

Add for printing

Executable files

Suspicious files

782

Text files

328

Unknown types

Dropped files

PID	Process	Filename		Type
1628	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10b5a6.TMP		—
		MD5:—	SHA256:—
1628	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old		—
		MD5:—	SHA256:—
1628	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10b5a6.TMP		—
		MD5:—	SHA256:—
1628	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old		—
		MD5:—	SHA256:—
1628	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10b5b5.TMP		—
		MD5:—	SHA256:—
1628	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10b5b5.TMP		—
		MD5:—	SHA256:—
1628	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old		—
		MD5:—	SHA256:—
1628	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old		—
		MD5:—	SHA256:—
1628	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10b5d5.TMP		—
		MD5:—	SHA256:—
1628	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

291

DNS requests

182

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6544	svchost.exe	GET	200	2.23.77.188:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
—	—	GET	200	2.16.164.49:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5384	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
5496	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5384	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
6572	svchost.exe	HEAD	200	2.22.242.227:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1746053240&P2=404&P3=2&P4=Ec6GPFvKeI7a0VfX2%2fg0E3rRtRwel2ZgqT261w45EmHcPB%2fVtFNHThUM7DRaXQgjup1Q6%2f5OPUMvRBlWBnwwvg%3d%3d	unknown	—	—	whitelisted
6572	svchost.exe	GET	206	2.22.242.227:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1746053240&P2=404&P3=2&P4=Ec6GPFvKeI7a0VfX2%2fg0E3rRtRwel2ZgqT261w45EmHcPB%2fVtFNHThUM7DRaXQgjup1Q6%2f5OPUMvRBlWBnwwvg%3d%3d	unknown	—	—	whitelisted
6572	svchost.exe	GET	206	2.22.242.227:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1746053240&P2=404&P3=2&P4=Ec6GPFvKeI7a0VfX2%2fg0E3rRtRwel2ZgqT261w45EmHcPB%2fVtFNHThUM7DRaXQgjup1Q6%2f5OPUMvRBlWBnwwvg%3d%3d	unknown	—	—	whitelisted
6572	svchost.exe	GET	206	2.22.242.227:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1746053240&P2=404&P3=2&P4=Ec6GPFvKeI7a0VfX2%2fg0E3rRtRwel2ZgqT261w45EmHcPB%2fVtFNHThUM7DRaXQgjup1Q6%2f5OPUMvRBlWBnwwvg%3d%3d	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	192.168.100.255:137	—	—	—	whitelisted
2104	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	2.16.164.49:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
—	—	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
5496	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
7216	msedge.exe	13.107.42.16:443	config.edge.skype.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
1628	msedge.exe	239.255.255.250:1900	—	—	—	whitelisted
7216	msedge.exe	150.171.27.11:443	edge.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 4.231.128.59	whitelisted
crl.microsoft.com	2.16.164.49 2.16.164.120	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
google.com	216.58.206.78	whitelisted
config.edge.skype.com	13.107.42.16	whitelisted
edge.microsoft.com	150.171.27.11 150.171.28.11	whitelisted
edge-mobile-static.azureedge.net	13.107.246.45	whitelisted
gofile.io	45.112.123.126	whitelisted
business.bing.com	13.107.6.158	whitelisted
bzib.nelreports.net	2.16.168.201 2.16.168.219 2.16.168.113 2.16.168.107	whitelisted

Threats

PID	Process	Class	Message
7216	msedge.exe	Potentially Bad Traffic	ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
7216	msedge.exe	Misc activity	ET FILE_SHARING File Sharing Related Domain in TLS SNI (gofile .io)
7216	msedge.exe	Potentially Bad Traffic	ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
7216	msedge.exe	Potentially Bad Traffic	ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
7216	msedge.exe	Potentially Bad Traffic	ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
7216	msedge.exe	Misc activity	ET FILE_SHARING File Sharing Related Domain in TLS SNI (gofile .io)
7216	msedge.exe	Potentially Bad Traffic	ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
7216	msedge.exe	Potentially Bad Traffic	ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
7216	msedge.exe	Misc activity	ET FILE_SHARING File Sharing Related Domain in TLS SNI (gofile .io)
7216	msedge.exe	Potentially Bad Traffic	ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)

Add for printing

No debug info

General Info

https://gofile.io/d/FkJq3p

D30ADD0C6C49D374D07B18AC8F717801

3C6A9EC0EDC3E5F9D75708F817CA1C35FA95BF16

369610A96DD02B90290766055128D34B165C5C6D3F75ECEDDDD7468747F84CAC

3:N8rxL1yvPV:2Zqt

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

WASPSTEALER has been detected (SURICATA)

Stealers network behavior

Changes powershell execution policy (Bypass)

Bypass execution policy to execute commands

Steals credentials from Web Browsers

Actions looks like stealing of personal data

Changes the login/logoff helper path in the registry

Uses Task Scheduler to autorun other applications

Create files in the Startup directory

Disables task manager

Changes the autorun value in the registry

SUSPICIOUS

Executes as Windows Service

Process drops legitimate windows executable

Reads the Windows owner or organization settings

Starts CMD.EXE for commands execution

Starts POWERSHELL.EXE for commands execution

Application launched itself

The process checks if it is being run in the virtual environment

Checks for external IP

Uses TASKKILL.EXE to kill process

Get information on the list of running processes

Starts NET.EXE to display or manage information about active sessions

Uses WMIC.EXE to obtain data on processes

Starts process via Powershell

Uses REG/REGEDIT.EXE to modify registry

Searches for installed software

The process executes Powershell scripts

The process bypasses the loading of PowerShell profile settings

Uses NETSH.EXE to obtain data on the network

Starts SC.EXE for service management

Restarts service on failure

Creates a new Windows service

The process executes VB scripts

Reads security settings of Internet Explorer

INFO

Checks supported languages

Attempting to use file storage service

Application launched itself

Reads Environment values

Reads the computer name

Reads Microsoft Office registry keys

Creates files or folders in the user directory

Manages system restore points

Executable content was dropped or overwritten

Creates a software uninstall entry

The sample compiled with english language support

Reads product name

Checks if a key exists in the options dictionary (POWERSHELL)

Reads the software policy settings

Manual execution by a user

Reads CPU info

Checks proxy server information

Reads the machine GUID from the registry

Node.js compiler has been detected

Reads security settings of Internet Explorer

The executable file from the user directory is run by the Powershell process

Process checks computer location settings

The Powershell gets current clipboard

Create files in a temporary directory

Creates files in the program directory

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information