popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ikpo.ps1

Generic Malware Hide_EXE UPX Confuser .NET Antivirus Malicious Library Malicious Packer AntiDebug DLL PE32 PE File .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Feb. 19, 2025, 11:23 a.m. Feb. 19, 2025, 11:35 a.m.
Size 442.1KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 d8ed066f1231767464642fe846f37d99
SHA256 ddde522180f0319a7442f0f7d93bcbaa5930483262d05af9a578848d309ede7e
CRC32 D1BC14EA
ssdeep 12288:iC8FAUMabHGDS9CnNGwsRVfM7xXyqx5Rb8SgIhWDV:D8FPHGDOCNud0xR5RbtgoWDV
Yara
  • hide_executable_file - Hide executable file

Name Response Post-Analysis Lookup
www.82765.ltd
A 103.117.135.13
A 43.251.56.161
A 103.42.144.142
CNAME an05-prod-x.cdn-ng.net
www.rds845.shop
A 148.72.247.70
CNAME rds845.shop
www.zkderby.xyz
A 13.248.169.48
A 76.223.54.146
www.blissfuljo.life
A 162.0.225.218
www.031234103.xyz
A 144.76.229.203
CNAME 031234103.xyz
www.bjogo.top
A 156.224.194.237
www.sqlite.org
A 45.33.6.223
www.birbacher.online
CNAME birbacher.online
A 217.160.0.24
IP Address Status Action
13.248.169.48 Active Moloch
144.76.229.203 Active Moloch
148.72.247.70 Active Moloch
156.224.194.237 Active Moloch
162.0.225.218 Active Moloch
164.124.101.2 Active Moloch
217.160.0.24 Active Moloch
43.251.56.161 Active Moloch
45.33.6.223 Active Moloch

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request POST http://www.rds845.shop/h0nr/
request GET http://www.rds845.shop/h0nr/?y_h6A2=5SMA7S/38P4RaRgCp3VO1tw2rROs9wah4HH5Q6yYr3Nu4ZqcK75SUzG8TXPdlVkL75Uc/7uyt+ZBxF8Sx8kUuaqQBEx7a3bwhtWi8pbBN6KWtUApBidRHQ/G3KkasTH6o4wmaSg=&60In=7wl5r0kQG9G
request GET http://www.sqlite.org/2021/sqlite-dll-win32-x86-3360000.zip
request POST http://www.82765.ltd/59d5/
request GET http://www.82765.ltd/59d5/?y_h6A2=qiWz9HwqJLKnYi7JlC6qkRM9oNVOe4dAvB5Yj2dX6M9d0oXA3FTQuLckJRO7ZlKIhJbHCMmlfOuDN9YpFc7H3lclNb/Uy7Zdu1Mg4MyeDmJL6C9SantxWX3ypDcfwQ2eRaZ57U8=&60In=7wl5r0kQG9G
request POST http://www.blissfuljo.life/p8fe/
request GET http://www.blissfuljo.life/p8fe/?y_h6A2=nweR1c0XBtkzZggi0v3dr9kB4xCEwoCGMBQNH/aYwX8LuhjLbL5HUgqXwTet0aQ44oxYgp72GiDpetq5GT3VFYsxr5RBWjhs308QLFo3+dsZTQkp8hunF2AzxzIui5HbDfaQI0w=&60In=7wl5r0kQG9G
request POST http://www.031234103.xyz/6gd2/
request GET http://www.031234103.xyz/6gd2/?y_h6A2=eDwP/8dm6CwnhXuB5IJF6tcmrP8qMyRusivP8vJ/CAl0CGhAGK7mzvA4v30eghRxdOMQU1afgYEQdjgAooUx1K4I/phOYtNowfmzMvro50gabBLkO4mInrSdt2aBNeYGRLrQQ4U=&60In=7wl5r0kQG9G
request POST http://www.zkderby.xyz/bqyq/
request GET http://www.zkderby.xyz/bqyq/?y_h6A2=Z6W2Due/iFNSY6roA058AuqdLgygAHlj29B3DLhDfw5gzakQrGCVCfu5pLO3yHC2Q5prfxENXL60nad/MKUoC8UQrxa2M0+WRd3DYf4bgsYWClNewfklrWL3J7GXJ+tZq73l4I4=&60In=7wl5r0kQG9G
request POST http://www.bjogo.top/0ekp/
request GET http://www.bjogo.top/0ekp/?y_h6A2=pV4l2sJ5SKTfO2UKe3vpYQms7oDV9Z1ZTd//bSk12oBNtulDh+GDNLKspI2ybbM6Ulb9MujLBOrC2bz5gPibbXkxWVg5NcqV4sd6rfkPD23v8QrCPt85paxIo96ZJG6eSxv1+xA=&60In=7wl5r0kQG9G
request POST http://www.birbacher.online/os5r/
request GET http://www.birbacher.online/os5r/?y_h6A2=231uHx8vc2OXjfRp9MqGfmAfw0ORoc0FHs1yPQI+Y8FHV11jaHQ2ftygF7Z20+LhG+hwvpvPffWcTqqpG/gNLui17mhEo7YUi96xAksmd+3++erClo3DLaj5tFD9ebrkUZzk9Dk=&60In=7wl5r0kQG9G
request POST http://www.rds845.shop/h0nr/
request POST http://www.82765.ltd/59d5/
request POST http://www.blissfuljo.life/p8fe/
request POST http://www.031234103.xyz/6gd2/
request POST http://www.zkderby.xyz/bqyq/
request POST http://www.bjogo.top/0ekp/
request POST http://www.birbacher.online/os5r/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0271b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0276f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x056b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00570000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00650000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2684
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2684
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f40000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02010000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2684
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003f2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2684
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02600000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3020
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00910000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000047b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file C:\Users\test22\AppData\Local\Chromium\User Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data
file C:\Users\test22\AppData\Local\Temp\x.exe
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\x.exe
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
buffer Buffer with sha1: cd4af01ead10ca106c2c37e8155c9a4d5e2cf98c
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 290816
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000258
1 0 0
file C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file C:\Users\test22\AppData\Local\AVG\Browser\User Data
file C:\Users\test22\AppData\Local\Temp\x.exe
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y  =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELÔWà  Xp@p@.textDVX `
base_address: 0x00400000
process_identifier: 2784
process_handle: 0x00000258
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2784
process_handle: 0x00000258
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y  =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELÔWà  Xp@p@.textDVX `
base_address: 0x00400000
process_identifier: 2784
process_handle: 0x00000258
1 1 0
Process injection Process 2684 called NtSetContextThread to modify thread in remote process 2784
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000254
process_identifier: 2784
1 0 0
parent_process powershell.exe martian_process "C:\Users\test22\AppData\Local\Temp\x.exe"
parent_process powershell.exe martian_process C:\Users\test22\AppData\Local\Temp\x.exe
Process injection Process 2684 resumed a thread in remote process 2784
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000254
suspend_count: 1
process_identifier: 2784
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000003d4
suspend_count: 1
process_identifier: 2552
1 0 0

CreateProcessInternalW

 thread_identifier: 2688
thread_handle: 0x000004d8
process_identifier: 2684
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\x.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\x.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\x.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000004e0
1 1 0

NtResumeThread

 thread_handle: 0x000004f8
suspend_count: 1
process_identifier: 2552
1 0 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2684
1 0 0

NtResumeThread

 thread_handle: 0x0000014c
suspend_count: 1
process_identifier: 2684
1 0 0

NtResumeThread

 thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 2684
1 0 0

NtResumeThread

 thread_handle: 0x000001e8
suspend_count: 1
process_identifier: 2684
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2684
1 0 0

NtResumeThread

 thread_handle: 0x000001fc
suspend_count: 1
process_identifier: 2684
1 0 0

NtResumeThread

 thread_handle: 0x00000210
suspend_count: 1
process_identifier: 2684
1 0 0

CreateProcessInternalW

 thread_identifier: 2788
thread_handle: 0x00000254
process_identifier: 2784
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000258
1 1 0

NtGetContextThread

 thread_handle: 0x00000254
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 290816
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000258
1 0 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2784
process_handle: 0x00000258
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@¸º´ Í!¸LÍ!This program cannot be run in DOS mode. $y  =`gó=`gó=`gó¦¨ó:`gó¦ªó<`gó¦«ó<`góRich=`góPELÔWà  Xp@p@.textDVX `
base_address: 0x00400000
process_identifier: 2784
process_handle: 0x00000258
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2784
process_handle: 0x00000258
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4199440
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000254
process_identifier: 2784
1 0 0

NtResumeThread

 thread_handle: 0x00000254
suspend_count: 1
process_identifier: 2784
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 3020
1 0 0

CreateProcessInternalW

 thread_identifier: 2496
thread_handle: 0x00000410
process_identifier: 2452
current_directory:
filepath: C:\Program Files\Mozilla Firefox\firefox.exe
track: 1
command_line:
filepath_r: C:\Program Files\Mozilla Firefox\Firefox.exe
stack_pivoted: 0
creation_flags: 12 (CREATE_SUSPENDED|DETACHED_PROCESS)
inherit_handles: 0
process_handle: 0x0000040c
1 1 0
file C:\Users\test22\AppData\Local\Temp\x.exe