Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe
Analysis ID:	1391079
MD5:	2d291baedb79ee55daa67417103f0905
SHA1:	810f2f9576976b3e68a610fbe2797b148c82766c
SHA256:	0df39b8c26a1b395b2389908f7dc4781aabba0aa10f4642baf46b8f1a9e2c426
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Signatures

AV Detection

Found malware configuration

Source: 10.2.lnYkIr.exe.445b050.12.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "us2.smtp.mailhostbox.com", "Username": "laju.varghese@grupocatqla.com", "Password": ")Ivlmuj5"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\lnYkIr.exe

ReversingLabs: Detection: 28%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

ReversingLabs: Detection: 28%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\lnYkIr.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 10.2.lnYkIr.exe.445b050.12.raw.unpack	String decryptor: u2R6%?_S
Source: 10.2.lnYkIr.exe.445b050.12.raw.unpack	String decryptor: $%5'$:
Source: 10.2.lnYkIr.exe.445b050.12.raw.unpack	String decryptor: `R cvJW&H(D(WAG
Source: 10.2.lnYkIr.exe.445b050.12.raw.unpack	String decryptor: cSXU]QyT~SXU]LyTcSEU]QyIcSXU]QyTcSXU
Source: 10.2.lnYkIr.exe.445b050.12.raw.unpack	String decryptor: 0=1 ?"6
Source: 10.2.lnYkIr.exe.445b050.12.raw.unpack	String decryptor: vFCY,)-
Source: 10.2.lnYkIr.exe.445b050.12.raw.unpack	String decryptor: uZ_C)
Source: 10.2.lnYkIr.exe.445b050.12.raw.unpack	String decryptor: rUB]TYSE

Uses 32bit PE files

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: sKdvLcn.pdb source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, lnYkIr.exe.0.dr
Source:	Binary string: sKdvLcn.pdbSHA256 source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, lnYkIr.exe.0.dr

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 4x nop then jmp 0B7F01F1h		0_2_0B7F0422
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 4x nop then jmp 0768EF19h		10_2_0768F14A

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 10.2.lnYkIr.exe.445b050.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.lnYkIr.exe.441fa30.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.4049f10.11.raw.unpack, type: UNPACKEDPE

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.5:49729 -> 208.91.198.143:587

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1

May check the online IP address of the machine

Source: unknown

DNS query: name: ip-api.com

Uses SMTP (mail sending)

Source: global traffic

TCP traffic: 192.168.2.5:49729 -> 208.91.198.143:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3366187385.0000000001390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3378982161.0000000006CF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3368803671.000000000328D000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3368762224.0000000002C3F000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3379016292.0000000006706000.00000004.00000020.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3367006333.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3366187385.000000000142D000.00000004.00000020.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3367006333.0000000000F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: lnYkIr.exe, 0000000E.00000002.3379016292.0000000006706000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertr
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3366187385.000000000142D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3378982161.0000000006CF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3368803671.000000000328D000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3367006333.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3368762224.0000000002C3F000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3367006333.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3367006333.0000000000F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3368803671.0000000003231000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3368762224.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000000.00000002.2146302322.000000000400E000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3368803671.0000000003231000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000A.00000002.2187787442.000000000441F000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3365722284.0000000000429000.00000040.00000400.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3368762224.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: lnYkIr.exe, 0000000E.00000002.3367006333.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingCi
Source: lnYkIr.exe, 0000000E.00000002.3367006333.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingyi;
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3366187385.0000000001390000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3378982161.0000000006CF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3368803671.000000000328D000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3368762224.0000000002C3F000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3379016292.0000000006706000.00000004.00000020.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3367006333.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3366187385.000000000142D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3378982161.0000000006CF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3368803671.000000000328D000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3367006333.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3368762224.0000000002C3F000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3367006333.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3367006333.0000000000F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0A
Source: lnYkIr.exe, 0000000E.00000002.3379016292.0000000006706000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.usertru
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000000.00000002.2145030822.0000000002E18000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3368803671.0000000003231000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000A.00000002.2186008382.0000000003228000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3368762224.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3368803671.000000000328D000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3368762224.0000000002C37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000000.00000002.2146302322.000000000400E000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000A.00000002.2187787442.000000000441F000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3365722284.0000000000429000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3366187385.000000000142D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3378982161.0000000006CF6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3368803671.000000000328D000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3367006333.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3368762224.0000000002C3F000.00000004.00000800.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3367006333.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, lnYkIr.exe, 0000000E.00000002.3367006333.0000000000F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.raw.unpack, J4qms1IPBw.cs

.Net Code: _4SbXE

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.lnYkIr.exe.441fa30.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.lnYkIr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.4049f10.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.lnYkIr.exe.445b050.12.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.lnYkIr.exe.445b050.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.lnYkIr.exe.441fa30.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.4049f10.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

.NET source code contains very large array initializations

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.2df41e8.5.raw.unpack, Architectural.cs

Large array initialization: : array initializer size 17982

Detected potential crypto function

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_052B79E8	0_2_052B79E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_052B03A8	0_2_052B03A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_052B0D68	0_2_052B0D68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_052B0D59	0_2_052B0D59
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_052B79D8	0_2_052B79D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_070E9798	0_2_070E9798
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_070EB6D2	0_2_070EB6D2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_070EB6E0	0_2_070EB6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_070EA440	0_2_070EA440
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_070EA008	0_2_070EA008
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_070E0C99	0_2_070E0C99
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_070E0CA8	0_2_070E0CA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_070E9BC2	0_2_070E9BC2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_070E9BD0	0_2_070E9BD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_0B7F0040	0_2_0B7F0040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_0B7F0040	0_2_0B7F0040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_0B7F0007	0_2_0B7F0007
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 9_2_030DC7B0	9_2_030DC7B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 9_2_030D4AC0	9_2_030D4AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 9_2_030DD0E7	9_2_030DD0E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 9_2_030D3EA8	9_2_030D3EA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 9_2_030D41F0	9_2_030D41F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 9_2_06FDDE10	9_2_06FDDE10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 9_2_06FD5980	9_2_06FD5980
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_01764B39	10_2_01764B39
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_0768ED68	10_2_0768ED68
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_07689798	10_2_07689798
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_0768B6E0	10_2_0768B6E0
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_0768B6D3	10_2_0768B6D3
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_0768A440	10_2_0768A440
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_0768A008	10_2_0768A008
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_0768ED59	10_2_0768ED59
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_07680CA8	10_2_07680CA8
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_07680C99	10_2_07680C99
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_07689BC3	10_2_07689BC3
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_07689BD0	10_2_07689BD0
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_0768ED68	10_2_0768ED68
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 14_2_01334AC0	14_2_01334AC0
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 14_2_0133D0E7	14_2_0133D0E7
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 14_2_01333EA8	14_2_01333EA8
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 14_2_013341F0	14_2_013341F0
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 14_2_069FDE10	14_2_069FDE10
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 14_2_069F5980	14_2_069F5980

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000000.00000002.2148269661.0000000007130000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000000.00000002.2145030822.0000000002E18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename3e301610-77d9-4d01-8699-0e498c12f7fa.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000000.00000000.2100144872.000000000098C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesKdvLcn.exe" vs SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000000.00000002.2142658019.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000000.00000002.2146302322.000000000400E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename3e301610-77d9-4d01-8699-0e498c12f7fa.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000000.00000002.2146302322.000000000400E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, 00000009.00000002.3366131390.0000000001358000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Binary or memory string: OriginalFilenamesKdvLcn.exe" vs SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Tries to load missing DLLs

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Section loaded: msasn1.dll

Uses 32bit PE files

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.lnYkIr.exe.441fa30.11.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.lnYkIr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.4049f10.11.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.lnYkIr.exe.445b050.12.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.lnYkIr.exe.445b050.12.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.lnYkIr.exe.441fa30.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.4049f10.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: lnYkIr.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.raw.unpack, Lds5plxAPDj.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.raw.unpack, LZYJybC.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.raw.unpack, wDxPSW1p.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.raw.unpack, E0w8WLnyggK.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.raw.unpack, ZBSJHga2buE.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.raw.unpack, M4oIYVa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.raw.unpack, kSS2HMsB8.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.400e8f0.10.raw.unpack, kSS2HMsB8.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, B54uhvmGLlyX4pN6ow.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, AfUbALyC500FynBqvI.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, AfUbALyC500FynBqvI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, AfUbALyC500FynBqvI.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, B54uhvmGLlyX4pN6ow.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, AfUbALyC500FynBqvI.cs	Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, AfUbALyC500FynBqvI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, AfUbALyC500FynBqvI.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@2/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

File created: C:\Users\user\AppData\Roaming\lnYkIr.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1084:120:WilError_03
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Mutant created: \Sessions\1\BaseNamedObjects\UlgJvs
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5084:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

File created: C:\Users\user\AppData\Local\Temp\tmp9C71.tmp

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lnYkIr.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lnYkIr" /XML "C:\Users\user\AppData\Local\Temp\tmp9C71.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\lnYkIr.exe C:\Users\user\AppData\Roaming\lnYkIr.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lnYkIr" /XML "C:\Users\user\AppData\Local\Temp\tmpADC6.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Process created: C:\Users\user\AppData\Roaming\lnYkIr.exe C:\Users\user\AppData\Roaming\lnYkIr.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lnYkIr.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lnYkIr" /XML "C:\Users\user\AppData\Local\Temp\tmp9C71.tmp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lnYkIr" /XML "C:\Users\user\AppData\Local\Temp\tmpADC6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Process created: C:\Users\user\AppData\Roaming\lnYkIr.exe C:\Users\user\AppData\Roaming\lnYkIr.exe	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: sKdvLcn.pdb source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, lnYkIr.exe.0.dr
Source:	Binary string: sKdvLcn.pdbSHA256 source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe, lnYkIr.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, AfUbALyC500FynBqvI.cs	.Net Code: bKmRjtHvbX System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, AfUbALyC500FynBqvI.cs	.Net Code: bKmRjtHvbX System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.2df41e8.5.raw.unpack, Ar.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_02BFA448 pushad ; ret	0_2_02BFA449
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 0_2_0B7F37DD push FFFFFF8Bh; iretd	0_2_0B7F37DF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 9_2_030D0708 push eax; ret	9_2_030D0712
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 9_2_030D0718 push eax; ret	9_2_030D0722
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 9_2_030D0728 push eax; ret	9_2_030D0732
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 9_2_030D06C8 push eax; ret	9_2_030D0702
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Code function: 9_2_06FD8FF0 pushfd ; retf	9_2_06FD8FFD
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_0176A44A push eax; ret	10_2_0176A451
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_0176A448 pushad ; ret	10_2_0176A449
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 10_2_0A6824B5 push FFFFFF8Bh; iretd	10_2_0A6824B7
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 14_2_01330718 push eax; ret	14_2_01330722
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 14_2_01330708 push eax; ret	14_2_01330712
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 14_2_01330698 push eax; ret	14_2_01330712
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 14_2_01330698 push eax; ret	14_2_01330732
Source: C:\Users\user\AppData\Roaming\lnYkIr.exe	Code function: 14_2_013306C8 push eax; ret	14_2_01330702

Source: SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Static PE information: section name: .text entropy: 7.900652138585597
Source: lnYkIr.exe.0.dr	Static PE information: section name: .text entropy: 7.900652138585597

Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, Y2xhaHzpVWr0qPqPe5.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'roQ0oNhaND', 'lcA0r2LlDp', 'JmR0BjiLGy', 'r7j06otRwI', 'Rld0vHVUtW', 'u2W00jaLyM', 'vUR0VAneCa'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, uSWedTON0pZsaQDlE7.cs	High entropy of concatenated method names: 'ToString', 'iZ0BiQxM4I', 'q9fBW589D3', 'ClfBK3sN1E', 'voJBFrTTpT', 'dWcBtSjELU', 'bZFBkQ4i6N', 'r9gBLrNNRg', 'TrvB3jjSVx', 'sHnB7jH9XC'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, elDDp3HPIobioVFnqi.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'YwKpwJPng2', 'S17pZGW9R2', 'I5bpzOhQuE', 'sDcUagCe6e', 'odeU4Rf2mD', 'rxXUpLgTRe', 'EssUUmSCYJ', 'bCWWOwWwyoxWFlxFFKx'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, M4CJD2cOceSjToPAu1.cs	High entropy of concatenated method names: 'Dispose', 'xhe4weBFJG', 'j8mpWwc3T2', 'cMP88Ct8gZ', 'p0R4ZcEy9O', 'BwT4zCDIhE', 'ProcessDialogKey', 'ffYpa9cqyC', 'LGFp4gxtdi', 'fSIppoAiv9'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, AcxjPt4arkHdo90ERvm.cs	High entropy of concatenated method names: 'WHZ0Y7UAYp', 'jrI0DX47wT', 't560jFmNWg', 'Tdf0GVBV7U', 'E3V0Tm4ohL', 'dF00ut0IWl', 'pCS0beK32v', 'gfV0mi2gdM', 'JJh0fAhUNL', 'kIW0ximueC'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, B54uhvmGLlyX4pN6ow.cs	High entropy of concatenated method names: 'km7c9pvgod', 'uJQc1iuFU4', 'KY3cOURNCJ', 'SQ8c8g1akg', 'T3mce2YRgE', 'nhvcPQCilT', 'QJEcAHfxIT', 'inHcCRUX4X', 'tM8cwj5Tli', 'YGYcZPKRTh'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, fRACX4xPO18mSo9ekl.cs	High entropy of concatenated method names: 'Fev5TXYnxG', 'aYj5b2WIDw', 'JKtHKxoYAF', 'VbhHFwxNwF', 'hOYHtZK4TB', 'bYSHk2pKrb', 'EwgHLaLNrR', 'B63H39SR9M', 'OriH7W8Nnt', 'f7FHQUvLyg'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, x9cqyCwLGFgxtdilSI.cs	High entropy of concatenated method names: 'XcRvghc9G9', 'pTRvW0XQGp', 'eifvKRW8v1', 'JTEvFmrXYI', 'L3dv9mcStw', 'dLZvtuncme', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, zXIgiB4p7fQ4TwLhUoH.cs	High entropy of concatenated method names: 'rp6VYRi78Y', 'UtQVDMbRuX', 'FBCVj9GjLv', 'CrENuxqmAvX5aN6qVXI', 'kB9XioqlMlTn2Bnlx4O', 'j3hP9mqU4NI7DPrbyEn', 'whYvyGqHoFbWlwooZIg', 'AsjXpGqhchxZPA5MwYJ'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, uOikXZRACP8fm5xu2c.cs	High entropy of concatenated method names: 'aTT4X54uhv', 'ALl4yyX4pN', 'LRY4n2JI2y', 'mOJ42NcRAC', 'o9e4rklstO', 'wZ64BREl3C', 'gcQpHNSptCWOA1KF2T', 'IMjPbHXN7HF8MSfHvM', 'DDqnfhK3LoRQZO0GN3', 's7n440L0DI'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, TR2kGu4UvRae0cmEBUc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kvSV9ZgSr9', 'syAV19mfbk', 'wLEVOhgnGP', 'yd4V89D8po', 'ETTVeuKvZc', 'yppVPVZwtT', 'Ah2VAbIqRm'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, nAiv9FZhRaIO79efY1.cs	High entropy of concatenated method names: 'gRN04fHUox', 'XGV0UkMy5P', 'kxH0RKSDmf', 'cQZ0lfhQ8E', 'JRW0cQOaaI', 'vEa0557Qof', 'rSE0q5rF74', 'PFHvA7gNGu', 'lZ4vCja3i0', 'FZavwxALT8'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, Pp43I3Lx3ZeQKe9E6s.cs	High entropy of concatenated method names: 'u6VXlU1R5c', 'J8nXHmrjgR', 'XR5Xqa2Wv1', 'RT8qZIhcVO', 'HEwqzFlFYv', 'EWSXaCQ2bt', 'wMQX4Bj2m7', 'A2kXpUOqa8', 'IvHXUL3aht', 'ho4XRXPJEB'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, JLNnh3fRY2JI2y2OJN.cs	High entropy of concatenated method names: 'A1AHGKQuBb', 'znyHu9wWGF', 'nXyHmjocTE', 'NOZHfjKQwo', 'fTeHrCR8pG', 'aHHHBh0ugJ', 'iB5H6VcOWw', 'hL4HvLX7Oh', 'u0dH042vfl', 'otUHVhaswq'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, on1bXYpw5Dbt7hdRmA.cs	High entropy of concatenated method names: 'jI5jAjCsp', 'n4MGAO8y8', 'lKLu3MNcl', 'zgebgMICY', 'N9xfdKXkw', 'sitx1i0Ll', 'wK3r1VbqTIt5tiuQW8', 'SQrl8eM5xUsxDs6ssa', 'VLMv7dgJ3', 'o4eVT5g5a'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, sRcEy9COTwTCDIhElf.cs	High entropy of concatenated method names: 'eJYvlbRXO3', 'ifQvcQRBXp', 'iJfvHoAOC8', 'CUNv5Qn3OQ', 'Y1bvqBKdpY', 'pCbvX0TrET', 'ss7vyYGxcH', 'ppBvMvj5nX', 'HFpvneeUBa', 'WAxv2LNKH5'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, MpRDFV9vBfpQsVwLWj.cs	High entropy of concatenated method names: 'aqFrQfQgKJ', 'kZErdK5u6F', 'KgYr9fmW8V', 'Y1pr15Iaa4', 'Oc1rWdX656', 'MydrKEYhBH', 'HQIrFgDEd0', 'P6urtEsei6', 'Gl0rk2I74F', 'WsPrL85ksI'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, utOIZ6gREl3CLe8Wuc.cs	High entropy of concatenated method names: 'qbSqNrJ7hr', 'RoRqc0CcKI', 'RU4q5LUNF1', 'TUWqXx9ef6', 'JSVqyrfu5U', 'kNG5etL0tI', 'B295PpbTtm', 'Jxm5AFjrh8', 'gSP5Cdhj5c', 'MNs5whkM6i'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, XfKWYy7qoSjnocn2Mt.cs	High entropy of concatenated method names: 'O94XYZHcjr', 'X47XD1YLTJ', 'YLHXjfOs2r', 'FMVXGT1p6M', 'VyRXT44A0r', 'Q5xXuvGTdW', 'B9yXbYtbF3', 'GVvXmbeyAZ', 'kcWXf8hTTc', 'R9uXx8tKPn'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, FRpcSaPxFAS6APJwiL.cs	High entropy of concatenated method names: 'vZt6C9cFrE', 'F4J6ZmrGnO', 'NnbvatH592', 'hWPv44IDVX', 'G576iY7Bir', 'r7B6dtrD59', 'FsS6ErAqvc', 'vfN69Dl8MI', 'oYj61ddqAd', 'awF6OnjUEx'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, AfUbALyC500FynBqvI.cs	High entropy of concatenated method names: 'adFUNab2jZ', 'WcnUlluGJ4', 'y7nUcJZChw', 'W9WUHKPyNM', 'vH5U5c3PMp', 'AnvUq5kUVi', 'vQgUXaYRU9', 'Q0uUyj96IC', 'S5qUMloObW', 'mhAUnu9DPI'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.413bc50.9.raw.unpack, f1PYmeE4fTIbqTOcMr.cs	High entropy of concatenated method names: 'bSQomyY0Rs', 'zyuoftb2np', 'DdLogIanfF', 'WFfoWSOW13', 'HEuoFkuIsC', 'JKDotqgu6i', 'rPQoLF19BS', 'gVso3BvOH6', 'oIUoQYeuAo', 'djCoi2l0ts'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, Y2xhaHzpVWr0qPqPe5.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'roQ0oNhaND', 'lcA0r2LlDp', 'JmR0BjiLGy', 'r7j06otRwI', 'Rld0vHVUtW', 'u2W00jaLyM', 'vUR0VAneCa'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, uSWedTON0pZsaQDlE7.cs	High entropy of concatenated method names: 'ToString', 'iZ0BiQxM4I', 'q9fBW589D3', 'ClfBK3sN1E', 'voJBFrTTpT', 'dWcBtSjELU', 'bZFBkQ4i6N', 'r9gBLrNNRg', 'TrvB3jjSVx', 'sHnB7jH9XC'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, elDDp3HPIobioVFnqi.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'YwKpwJPng2', 'S17pZGW9R2', 'I5bpzOhQuE', 'sDcUagCe6e', 'odeU4Rf2mD', 'rxXUpLgTRe', 'EssUUmSCYJ', 'bCWWOwWwyoxWFlxFFKx'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, M4CJD2cOceSjToPAu1.cs	High entropy of concatenated method names: 'Dispose', 'xhe4weBFJG', 'j8mpWwc3T2', 'cMP88Ct8gZ', 'p0R4ZcEy9O', 'BwT4zCDIhE', 'ProcessDialogKey', 'ffYpa9cqyC', 'LGFp4gxtdi', 'fSIppoAiv9'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, AcxjPt4arkHdo90ERvm.cs	High entropy of concatenated method names: 'WHZ0Y7UAYp', 'jrI0DX47wT', 't560jFmNWg', 'Tdf0GVBV7U', 'E3V0Tm4ohL', 'dF00ut0IWl', 'pCS0beK32v', 'gfV0mi2gdM', 'JJh0fAhUNL', 'kIW0ximueC'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, B54uhvmGLlyX4pN6ow.cs	High entropy of concatenated method names: 'km7c9pvgod', 'uJQc1iuFU4', 'KY3cOURNCJ', 'SQ8c8g1akg', 'T3mce2YRgE', 'nhvcPQCilT', 'QJEcAHfxIT', 'inHcCRUX4X', 'tM8cwj5Tli', 'YGYcZPKRTh'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, fRACX4xPO18mSo9ekl.cs	High entropy of concatenated method names: 'Fev5TXYnxG', 'aYj5b2WIDw', 'JKtHKxoYAF', 'VbhHFwxNwF', 'hOYHtZK4TB', 'bYSHk2pKrb', 'EwgHLaLNrR', 'B63H39SR9M', 'OriH7W8Nnt', 'f7FHQUvLyg'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, x9cqyCwLGFgxtdilSI.cs	High entropy of concatenated method names: 'XcRvghc9G9', 'pTRvW0XQGp', 'eifvKRW8v1', 'JTEvFmrXYI', 'L3dv9mcStw', 'dLZvtuncme', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, zXIgiB4p7fQ4TwLhUoH.cs	High entropy of concatenated method names: 'rp6VYRi78Y', 'UtQVDMbRuX', 'FBCVj9GjLv', 'CrENuxqmAvX5aN6qVXI', 'kB9XioqlMlTn2Bnlx4O', 'j3hP9mqU4NI7DPrbyEn', 'whYvyGqHoFbWlwooZIg', 'AsjXpGqhchxZPA5MwYJ'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, uOikXZRACP8fm5xu2c.cs	High entropy of concatenated method names: 'aTT4X54uhv', 'ALl4yyX4pN', 'LRY4n2JI2y', 'mOJ42NcRAC', 'o9e4rklstO', 'wZ64BREl3C', 'gcQpHNSptCWOA1KF2T', 'IMjPbHXN7HF8MSfHvM', 'DDqnfhK3LoRQZO0GN3', 's7n440L0DI'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, TR2kGu4UvRae0cmEBUc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kvSV9ZgSr9', 'syAV19mfbk', 'wLEVOhgnGP', 'yd4V89D8po', 'ETTVeuKvZc', 'yppVPVZwtT', 'Ah2VAbIqRm'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, nAiv9FZhRaIO79efY1.cs	High entropy of concatenated method names: 'gRN04fHUox', 'XGV0UkMy5P', 'kxH0RKSDmf', 'cQZ0lfhQ8E', 'JRW0cQOaaI', 'vEa0557Qof', 'rSE0q5rF74', 'PFHvA7gNGu', 'lZ4vCja3i0', 'FZavwxALT8'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, Pp43I3Lx3ZeQKe9E6s.cs	High entropy of concatenated method names: 'u6VXlU1R5c', 'J8nXHmrjgR', 'XR5Xqa2Wv1', 'RT8qZIhcVO', 'HEwqzFlFYv', 'EWSXaCQ2bt', 'wMQX4Bj2m7', 'A2kXpUOqa8', 'IvHXUL3aht', 'ho4XRXPJEB'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, JLNnh3fRY2JI2y2OJN.cs	High entropy of concatenated method names: 'A1AHGKQuBb', 'znyHu9wWGF', 'nXyHmjocTE', 'NOZHfjKQwo', 'fTeHrCR8pG', 'aHHHBh0ugJ', 'iB5H6VcOWw', 'hL4HvLX7Oh', 'u0dH042vfl', 'otUHVhaswq'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, on1bXYpw5Dbt7hdRmA.cs	High entropy of concatenated method names: 'jI5jAjCsp', 'n4MGAO8y8', 'lKLu3MNcl', 'zgebgMICY', 'N9xfdKXkw', 'sitx1i0Ll', 'wK3r1VbqTIt5tiuQW8', 'SQrl8eM5xUsxDs6ssa', 'VLMv7dgJ3', 'o4eVT5g5a'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, sRcEy9COTwTCDIhElf.cs	High entropy of concatenated method names: 'eJYvlbRXO3', 'ifQvcQRBXp', 'iJfvHoAOC8', 'CUNv5Qn3OQ', 'Y1bvqBKdpY', 'pCbvX0TrET', 'ss7vyYGxcH', 'ppBvMvj5nX', 'HFpvneeUBa', 'WAxv2LNKH5'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, MpRDFV9vBfpQsVwLWj.cs	High entropy of concatenated method names: 'aqFrQfQgKJ', 'kZErdK5u6F', 'KgYr9fmW8V', 'Y1pr15Iaa4', 'Oc1rWdX656', 'MydrKEYhBH', 'HQIrFgDEd0', 'P6urtEsei6', 'Gl0rk2I74F', 'WsPrL85ksI'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, utOIZ6gREl3CLe8Wuc.cs	High entropy of concatenated method names: 'qbSqNrJ7hr', 'RoRqc0CcKI', 'RU4q5LUNF1', 'TUWqXx9ef6', 'JSVqyrfu5U', 'kNG5etL0tI', 'B295PpbTtm', 'Jxm5AFjrh8', 'gSP5Cdhj5c', 'MNs5whkM6i'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, XfKWYy7qoSjnocn2Mt.cs	High entropy of concatenated method names: 'O94XYZHcjr', 'X47XD1YLTJ', 'YLHXjfOs2r', 'FMVXGT1p6M', 'VyRXT44A0r', 'Q5xXuvGTdW', 'B9yXbYtbF3', 'GVvXmbeyAZ', 'kcWXf8hTTc', 'R9uXx8tKPn'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, FRpcSaPxFAS6APJwiL.cs	High entropy of concatenated method names: 'vZt6C9cFrE', 'F4J6ZmrGnO', 'NnbvatH592', 'hWPv44IDVX', 'G576iY7Bir', 'r7B6dtrD59', 'FsS6ErAqvc', 'vfN69Dl8MI', 'oYj61ddqAd', 'awF6OnjUEx'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, AfUbALyC500FynBqvI.cs	High entropy of concatenated method names: 'adFUNab2jZ', 'WcnUlluGJ4', 'y7nUcJZChw', 'W9WUHKPyNM', 'vH5U5c3PMp', 'AnvUq5kUVi', 'vQgUXaYRU9', 'Q0uUyj96IC', 'S5qUMloObW', 'mhAUnu9DPI'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.7130000.14.raw.unpack, f1PYmeE4fTIbqTOcMr.cs	High entropy of concatenated method names: 'bSQomyY0Rs', 'zyuoftb2np', 'DdLogIanfF', 'WFfoWSOW13', 'HEuoFkuIsC', 'JKDotqgu6i', 'rPQoLF19BS', 'gVso3BvOH6', 'oIUoQYeuAo', 'djCoi2l0ts'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.70d0000.13.raw.unpack, ReactionVessel.cs	High entropy of concatenated method names: 'CopyMemory', 'SearchResult', 'CausalitySource', 'K4oTsswVn', 'ComputeReaction', 'ResizeVessel', 'Inject', 'c6vkj3brm', 'Init', 'Init'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe.30790cc.3.raw.unpack, ReactionVessel.cs	High entropy of concatenated method names: 'CopyMemory', 'SearchResult', 'CausalitySource', 'K4oTsswVn', 'ComputeReaction', 'ResizeVessel', 'Inject', 'c6vkj3brm', 'Init', 'Init'

Drops PE files

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

File created: C:\Users\user\AppData\Roaming\lnYkIr.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lnYkIr" /XML "C:\Users\user\AppData\Local\Temp\tmp9C71.tmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: <

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.4960.23508.exe

Malware Threat Intel
Provided by