Windows Analysis Report
SecuriteInfo.com.FileRepMalware.18165.2747.exe

Overview

General Information

Sample name: SecuriteInfo.com.FileRepMalware.18165.2747.exe
Analysis ID: 1427003
MD5: 31a627f2a00461e5049a9060ac33c9ab
SHA1: 044f5c5619686f5a0be94e8bff071b61202ba534
SHA256: 6a8d081b1a9df5c8f61aff5782a2c43d2d98ec11a971482916231309a12f6fe0
Tags: exe
Infos:

Detection

Score: 44
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Allocates memory in foreign processes
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Windows shortcut file (LNK) contains suspicious command line arguments
Writes to foreign memory regions
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains executable resources (Code or Archives)
Queries keyboard layouts
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Stores files to the Windows start menu directory
Too many similar processes found
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe ReversingLabs: Detection: 31%
Uses 32bit PE files
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Local\Links\InstalledLinks.txt Jump to behavior
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Windows\explorer.exe Directory queried: number of queries: 1001
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
May check the online IP address of the machine
Source: unknown DNS query: name: ipinfo.io
Source: unknown DNS query: name: ipinfo.io
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /country HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: ipinfo.io
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /country HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: ipinfo.io
Source: unknown DNS traffic detected: queries for: ipinfo.io
Source: explorer.exe, 00000006.00000000.2194938402.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2194938402.000000000973C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000006.00000000.2194938402.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2194938402.000000000973C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000006.00000000.2194938402.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2194938402.000000000973C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000006.00000000.2194938402.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2194938402.000000000973C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000006.00000000.2194938402.000000000962B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000006.00000000.2193237768.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.2193221327.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.2190558210.00000000028A0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2054638035.0000000002430000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2582891225.0000000002260000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2572795137.0000000002322000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2057294604.00000000032F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.dk-soft.org/
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2055626690.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2055271458.0000000002430000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000000.2056521375.0000000000401000.00000020.00000001.01000000.00000004.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp.0.dr String found in binary or memory: http://www.innosetup.com/
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2055626690.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2055271458.0000000002430000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000000.2056521375.0000000000401000.00000020.00000001.01000000.00000004.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp.0.dr String found in binary or memory: http://www.remobjects.com/ps
Source: explorer.exe, 00000006.00000000.2195612718.00000000099AB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 00000006.00000000.2221657822.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000006.00000000.2194938402.000000000962B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000006.00000000.2194938402.000000000962B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/I
Source: explorer.exe, 00000006.00000000.2194938402.000000000973C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000006.00000000.2194938402.000000000962B000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2194938402.000000000973C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000006.00000000.2194938402.000000000973C000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
Source: explorer.exe, 00000006.00000000.2221657822.000000000C048000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.com-
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2054638035.0000000002430000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2582891225.0000000002273000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2572795137.0000000002322000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2572066007.0000000003C03000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2572066007.0000000003B75000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2057294604.00000000032F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/country
Source: explorer.exe, 00000006.00000000.2221657822.000000000C048000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.come
Source: explorer.exe, 00000006.00000000.2221657822.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.comEMd
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2054638035.0000000002430000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2582891225.0000000002273000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2572795137.0000000002322000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2572066007.0000000003BE9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2572066007.0000000003B75000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2057294604.00000000032F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://stvkr.com/click-
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2054638035.0000000002430000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2582891225.0000000002273000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2572795137.0000000002322000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2572066007.0000000003BE9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2572066007.0000000003B75000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2057294604.00000000032F0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://terra.im/gl/?cid=$
Source: SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2572795137.0000000002354000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2572795137.000000000238B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://terra.im/gl/?cid=&oid=$
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000006.00000000.2195612718.00000000099AB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://wns.windows.com/e
Source: explorer.exe, 00000006.00000000.2221657822.000000000C048000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.comM
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2572795137.000000000234C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=$
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000020.db.6.dr, Atomic Heart.lnk0.1.dr, Atomic Heart.lnk.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=1115&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000020.db.6.dr, Battle Teams.lnk.1.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=1140&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=171&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=1925&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000020.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=19705&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000020.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=19706&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000020.db.6.dr, {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001e.db.6.dr, Warface.lnk.6.dr, {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=20935&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000020.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=24765&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000020.db.6.dr, World of Warships.lnk.1.dr, World of Warships.lnk0.1.dr, World of Warships (2).lnk.6.dr, World of Warships (2).lnk0.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=24766&v=6&utm_campaign=test&trash=
Source: explorer.exe, 00000006.00000000.2220404353.000000000A762000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2406303001.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2413573617.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2429833687.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2410964306.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2408462239.000000000C354000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000003.2407449184.000000000C354000.00000004.00000001.00020000.00000000.sdmp, {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000021.db.6.dr, {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db.6.dr, Aliexpress.lnk0.1.dr, Aliexpress.lnk.6.dr, Aliexpress.lnk.1.dr, {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000020.db.6.dr, {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001e.db.6.dr, {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=27233&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000020.db.6.dr, ArcheAge.lnk0.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=29103&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=29150&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=34283&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000020.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=3480053&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=6735&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=833&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=911&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=NgRKk7SD&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=dFjmQFjX&v=6&utm_campaign=test&trash=
Source: {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.6.dr String found in binary or memory: https://yagoaway.ru/gl/?cid=&oid=mZWZvCwR&v=6&utm_campaign=test&trash=
Source: unknown Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.6:49699 version: TLS 1.2
Too many similar processes found
Source: shortcut.exe Process created: 55

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR Matched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Windows shortcut file (LNK) contains suspicious command line arguments
Source: Perfect World.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=3480053&v=6&utm_campaign=test&trash="
Source: Perfect World.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=3480053&v=6&utm_campaign=test&trash="
Source: ArcheAge.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=29103&v=6&utm_campaign=test&trash="
Source: ArcheAge.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=29103&v=6&utm_campaign=test&trash="
Source: Aliexpress.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=27233&v=6&utm_campaign=test&trash="
Source: Aliexpress.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=27233&v=6&utm_campaign=test&trash="
Source: Blood and Soul.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=171&v=6&utm_campaign=test&trash="
Source: Blood and Soul.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=171&v=6&utm_campaign=test&trash="
Source: Caliber.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=911&v=6&utm_campaign=test&trash="
Source: Caliber.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=911&v=6&utm_campaign=test&trash="
Source: Crossout.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=29150&v=6&utm_campaign=test&trash="
Source: Crossout.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=29150&v=6&utm_campaign=test&trash="
Source: Enlisted.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=34283&v=6&utm_campaign=test&trash="
Source: Enlisted.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=34283&v=6&utm_campaign=test&trash="
Source: Lost Ark.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=833&v=6&utm_campaign=test&trash="
Source: Lost Ark.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=833&v=6&utm_campaign=test&trash="
Source: ???????? ??????? ???????.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=NgRKk7SD&v=6&utm_campaign=test&trash="
Source: ???????? ??????? ???????.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=NgRKk7SD&v=6&utm_campaign=test&trash="
Source: Rail Nation.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=6735&v=6&utm_campaign=test&trash="
Source: Rail Nation.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=6735&v=6&utm_campaign=test&trash="
Source: ???????? ?????? Steam.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=dFjmQFjX&v=6&utm_campaign=test&trash="
Source: ???????? ?????? Steam.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=dFjmQFjX&v=6&utm_campaign=test&trash="
Source: War Thunder.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=1925&v=6&utm_campaign=test&trash="
Source: War Thunder.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=1925&v=6&utm_campaign=test&trash="
Source: Warface.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=20935&v=6&utm_campaign=test&trash="
Source: Warface.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=20935&v=6&utm_campaign=test&trash="
Source: World of Tanks.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=19706&v=6&utm_campaign=test&trash="
Source: Atomic Heart.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=1115&v=6&utm_campaign=test&trash="
Source: Atomic Heart.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=1115&v=6&utm_campaign=test&trash="
Source: Battle Teams.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=1140&v=6&utm_campaign=test&trash="
Source: Battle Teams.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=1140&v=6&utm_campaign=test&trash="
Source: World of Tanks.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=19706&v=6&utm_campaign=test&trash="
Source: World of Warships.lnk.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=24766&v=6&utm_campaign=test&trash="
Source: World of Warships.lnk0.1.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=24766&v=6&utm_campaign=test&trash="
Source: World of Warships.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=24765&v=6&utm_campaign=test&trash="
Source: World of Warships.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=24765&v=6&utm_campaign=test&trash="
Source: World of Warships (2).lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=24766&v=6&utm_campaign=test&trash="
Source: World of Warships (2).lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=24766&v=6&utm_campaign=test&trash="
Source: Perfect World.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=3480053&v=6&utm_campaign=test&trash="
Source: Perfect World.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=3480053&v=6&utm_campaign=test&trash="
Source: ArcheAge.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=29103&v=6&utm_campaign=test&trash="
Source: Aliexpress.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=27233&v=6&utm_campaign=test&trash="
Source: Blood and Soul.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=171&v=6&utm_campaign=test&trash="
Source: Blood and Soul.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=171&v=6&utm_campaign=test&trash="
Source: Caliber.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=911&v=6&utm_campaign=test&trash="
Source: Caliber.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=911&v=6&utm_campaign=test&trash="
Source: Crossout.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=29150&v=6&utm_campaign=test&trash="
Source: Crossout.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=29150&v=6&utm_campaign=test&trash="
Source: Enlisted.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=34283&v=6&utm_campaign=test&trash="
Source: Enlisted.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=34283&v=6&utm_campaign=test&trash="
Source: Lost Ark.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=833&v=6&utm_campaign=test&trash="
Source: Lost Ark.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=833&v=6&utm_campaign=test&trash="
Source: ???????? ??????? ???????.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=NgRKk7SD&v=6&utm_campaign=test&trash="
Source: ???????? ??????? ???????.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=NgRKk7SD&v=6&utm_campaign=test&trash="
Source: Rail Nation.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=6735&v=6&utm_campaign=test&trash="
Source: Rail Nation.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=6735&v=6&utm_campaign=test&trash="
Source: ???????? ?????? Steam.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=mZWZvCwR&v=6&utm_campaign=test&trash="
Source: ???????? ?????? Steam.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=mZWZvCwR&v=6&utm_campaign=test&trash="
Source: ???????? ?????? Steam (2).lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=dFjmQFjX&v=6&utm_campaign=test&trash="
Source: ???????? ?????? Steam (2).lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=dFjmQFjX&v=6&utm_campaign=test&trash="
Source: War Thunder.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=1925&v=6&utm_campaign=test&trash="
Source: War Thunder.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=1925&v=6&utm_campaign=test&trash="
Source: Warface.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=20935&v=6&utm_campaign=test&trash="
Source: Warface.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=20935&v=6&utm_campaign=test&trash="
Source: ArcheAge.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=29103&v=6&utm_campaign=test&trash="
Source: Atomic Heart.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=1115&v=6&utm_campaign=test&trash="
Source: Atomic Heart.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=1115&v=6&utm_campaign=test&trash="
Source: Battle Teams.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=1140&v=6&utm_campaign=test&trash="
Source: World of Tanks.lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=19705&v=6&utm_campaign=test&trash="
Source: Battle Teams.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=1140&v=6&utm_campaign=test&trash="
Source: World of Tanks.lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=19705&v=6&utm_campaign=test&trash="
Source: World of Tanks (2).lnk.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=19706&v=6&utm_campaign=test&trash="
Source: World of Tanks (2).lnk0.6.dr LNK file: url,OpenURL "https://yagoaway.ru/gl/?cid=&oid=19706&v=6&utm_campaign=test&trash="
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Code function: 3_2_00007FF6918C17A8 3_2_00007FF6918C17A8
Source: C:\Windows\explorer.exe Code function: 6_3_00F717A8 6_3_00F717A8
Source: C:\Windows\explorer.exe Code function: 6_3_02E017A8 6_3_02E017A8
Source: C:\Windows\explorer.exe Code function: 6_3_141D17A8 6_3_141D17A8
Source: C:\Windows\explorer.exe Code function: 6_3_00E917A8 6_3_00E917A8
Source: C:\Windows\explorer.exe Code function: 6_3_051A17A8 6_3_051A17A8
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe 07D6C3A19A8E3E243E9545A41DD30A9EE1E9AD79CDD6D446C229D689E5AB574A
PE file contains executable resources (Code or Archives)
Source: SecuriteInfo.com.FileRepMalware.18165.2747.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: SecuriteInfo.com.FileRepMalware.18165.2747.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2054638035.0000000002430000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesyspin.exe@ vs SecuriteInfo.com.FileRepMalware.18165.2747.exe
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2582891225.0000000002273000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesyspin.exe@ vs SecuriteInfo.com.FileRepMalware.18165.2747.exe
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2055626690.000000007FE3F000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameshfolder.dll~/ vs SecuriteInfo.com.FileRepMalware.18165.2747.exe
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2055271458.0000000002553000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameshfolder.dll~/ vs SecuriteInfo.com.FileRepMalware.18165.2747.exe
Uses 32bit PE files
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Yara signature match
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR Matched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56
Source: classification engine Classification label: mal44.evad.winEXE@96/123@1/1
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Code function: 3_2_00007FF6918C1A14 GetModuleHandleW,LoadStringW,CoCreateInstance,VariantInit,VariantInit, 3_2_00007FF6918C1A14
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2688:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3380:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3200:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2364:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5132:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5040:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6720:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:420:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5608:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2444:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6688:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5252:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5960:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2100:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5632:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7032:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1780:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2324:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7092:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2872:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2268:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3924:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6436:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6488:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5912:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6748:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2912:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe File created: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization Jump to behavior
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe ReversingLabs: Detection: 31%
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe String found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe Process created: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp "C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp" /SL5="$203B8,1938865,172032,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe"
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Aliexpress.lnk" 5386
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Aliexpress.lnk" 51201
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Blood and Soul.lnk" 5386
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Blood and Soul.lnk" 51201
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Caliber.lnk" 5386
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Caliber.lnk" 51201
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Crossout.lnk" 5386
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Crossout.lnk" 51201
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Enlisted.lnk" 5386
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Enlisted.lnk" 51201
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Lost Ark.lnk" 5386
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Lost Ark.lnk" 51201
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ??????? ???????.lnk" 5386
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ??????? ???????.lnk" 51201
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Rail Nation.lnk" 5386
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Rail Nation.lnk" 51201
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ?????? Steam.lnk" 5386
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ?????? Steam.lnk" 51201
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ?????? Steam.lnk" 5386
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\War Thunder.lnk" 5386
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\War Thunder.lnk" 51201
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Warface.lnk" 5386
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Warface.lnk" 51201
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\World of Tanks.lnk" 5386
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\World of Tanks.lnk" 51201
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\World of Warships.lnk" 5386
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe Process created: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp "C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp" /SL5="$203B8,1938865,172032,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Aliexpress.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Aliexpress.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Blood and Soul.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Blood and Soul.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Caliber.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Caliber.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Crossout.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Crossout.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Enlisted.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Enlisted.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Lost Ark.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Lost Ark.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ??????? ???????.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ??????? ???????.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Rail Nation.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Rail Nation.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ?????? Steam.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ?????? Steam.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ?????? Steam.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Caliber.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\War Thunder.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\War Thunder.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Warface.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Warface.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\World of Tanks.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\World of Tanks.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ??????? ???????.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ??????? ???????.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\World of Warships.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: winhttpcom.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: mlang.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: twext.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: drprov.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ntlanman.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: davclnt.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: davhlpr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: playtodevice.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ehstorapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: zipfldr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sendmail.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mydocs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: acppage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.internal.shell.broker.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: Perfect World.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: Perfect World.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: ArcheAge.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: ArcheAge.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Aliexpress.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: Aliexpress.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Blood and Soul.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: Blood and Soul.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Caliber.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: Caliber.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Crossout.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: Crossout.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Enlisted.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: Enlisted.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Lost Ark.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: Lost Ark.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: ???????? ??????? ???????.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: ???????? ??????? ???????.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Rail Nation.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: Rail Nation.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: ???????? ?????? Steam.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: ???????? ?????? Steam.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: War Thunder.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: War Thunder.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Warface.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: Warface.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: World of Tanks.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: Atomic Heart.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: Atomic Heart.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Battle Teams.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: Battle Teams.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: World of Tanks.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: World of Warships.lnk.1.dr LNK file: ..\..\..\Windows\system32\rundll32.exe
Source: World of Warships.lnk0.1.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: World of Warships.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: World of Warships.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: World of Warships (2).lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: World of Warships (2).lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Perfect World.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Perfect World.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: ArcheAge.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Aliexpress.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Blood and Soul.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Blood and Soul.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Caliber.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Caliber.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Crossout.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Crossout.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Enlisted.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Enlisted.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Lost Ark.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Lost Ark.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: ???????? ??????? ???????.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: ???????? ??????? ???????.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Rail Nation.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Rail Nation.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: ???????? ?????? Steam.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: ???????? ?????? Steam.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: ???????? ?????? Steam (2).lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: ???????? ?????? Steam (2).lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: War Thunder.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: War Thunder.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Warface.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Warface.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: ArcheAge.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Atomic Heart.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Atomic Heart.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Battle Teams.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: World of Tanks.lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: Battle Teams.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: World of Tanks.lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: World of Tanks (2).lnk.6.dr LNK file: ..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: World of Tanks (2).lnk0.6.dr LNK file: ..\..\..\..\..\..\..\..\Windows\system32\rundll32.exe
Source: C:\Windows\explorer.exe File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Window found: window name: TMainForm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Automated click: Install
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall Jump to behavior
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe Static file information: File size 2372376 > 1048576
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe File created: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Local\Links\InstalledLinks.txt Jump to behavior

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Window found: window name: Progman
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Aliexpress.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Blood and Soul.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Caliber.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Crossout.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Enlisted.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Lost Ark.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ??????? ???????.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Rail Nation.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ?????? Steam.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\War Thunder.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Warface.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\World of Tanks.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\World of Warships.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Perfect World.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\ArcheAge.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Atomic Heart.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Battle Teams.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Blood and Soul.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Caliber.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crossout.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Enlisted.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lost Ark.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\???????? ??????? ???????.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rail Nation.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\???????? ?????? Steam.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\???????? ?????? Steam (2).lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\War Thunder.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warface.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Tanks.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Tanks (2).lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Warships.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Warships (2).lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Perfect World.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ArcheAge.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Atomic Heart.lnk Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Battle Teams.lnk Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.18165.2747.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 860
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\_isetup\_setup64.tmp Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp TID: 2216 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries keyboard layouts
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: explorer.exe, 00000006.00000003.2439199889.00000000148A9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.2194938402.000000000962B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\msmouse.inf_locv
Source: explorer.exe, 00000006.00000000.2221657822.000000000C048000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000003.2590339656.0000000014A0A000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}R_PROF
Source: explorer.exe, 00000006.00000000.2195612718.00000000098AD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}RoamingCom
Source: explorer.exe, 00000006.00000003.2580575869.0000000014852000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@
Source: explorer.exe, 00000006.00000000.2189789350.0000000000D99000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2576889912.0000000000759000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.2194938402.000000000978C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000006.00000000.2192281711.00000000073E5000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000006.00000003.2439199889.00000000148A9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}S
Source: explorer.exe, 00000006.00000003.2590339656.0000000014A0A000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}OR_LEVQe
Source: explorer.exe, 00000006.00000000.2221657822.000000000C048000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Users^
Source: explorer.exe, 00000006.00000000.2195612718.00000000098AD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2577666205.0000000003350000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000002.2581079488.0000000003350000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2561266043.0000000003345000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWxv%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000006.00000003.2407449184.000000000C354000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: _VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.2195612718.00000000097F3000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000006.00000000.2194938402.000000000973C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWws
Source: explorer.exe, 00000006.00000003.2580575869.0000000014852000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}32.dll,-21786
Source: explorer.exe, 00000006.00000000.2194938402.0000000009605000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NXTVMWare
Source: explorer.exe, 00000006.00000000.2189789350.0000000000D99000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000W
Source: explorer.exe, 00000006.00000003.2419993482.00000000147F0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: AGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.2195612718.00000000098AD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}lnkramW6
Source: SecuriteInfo.com.FileRepMalware.18165.2747.tmp, 00000001.00000003.2576889912.0000000000759000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@
Source: explorer.exe, 00000006.00000000.2189789350.0000000000D99000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000006.00000000.2189789350.0000000000D99000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process information queried: ProcessInformation Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: F70000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 141D0000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 2E00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: E90000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: E90000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: E90000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 162D0000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 51A0000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 51A0000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 51A0000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 51A0000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 51A0000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory allocated: C:\Windows\explorer.exe base: 51A0000 protect: page execute and read and write
Contains functionality to inject threads in other processes
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Code function: 3_2_00007FF6918C17A8 GetModuleHandleW,IsBadReadPtr,VirtualAllocEx,VirtualAlloc,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,TerminateThread,CloseHandle,VirtualFree,VirtualFreeEx, 3_2_00007FF6918C17A8
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: C:\Windows\explorer.exe EIP: F719D8 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 141D19D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 2E019D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: E919D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: E919D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: E919D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 162D19D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 51A19D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 51A19D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 51A19D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 51A19D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 51A19D8
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Thread created: unknown EIP: 51A19D8
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: F70000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 141D0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: E90000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: E90000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: E90000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 162D0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A0000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A0000 value starts with: 4D5A
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: F70000 value: 4D Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: F79000 value: 41 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 41
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 42
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 42
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 43
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 43
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 43
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 43
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 45
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 45
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 4C
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 4C
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 20
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 20
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 52
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 141D0000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 141D9000 value: 52
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 20
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 20
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E00000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 2E09000 value: 20
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: E90000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: E99000 value: 20
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: E90000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: E99000 value: 57
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: E90000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: E99000 value: 57
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 162D0000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 162D9000 value: 57
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 51A0000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 51A9000 value: 57
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 51A0000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 51A9000 value: 57
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 51A0000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 51A9000 value: 57
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 51A0000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 51A9000 value: 57
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 51A0000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 51A9000 value: 57
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 51A0000 value: 4D
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: PID: 4004 base: 51A9000 value: 57
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: F70000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: F79000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 141D0000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 141D9000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E00000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 2E09000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: E90000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: E99000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: E90000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: E99000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: E90000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: E99000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 162D0000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 162D9000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A0000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A9000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A0000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A9000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A0000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A9000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A0000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A9000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A0000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A9000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A0000
Source: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe Memory written: C:\Windows\explorer.exe base: 51A9000
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Aliexpress.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Aliexpress.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Blood and Soul.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Blood and Soul.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Caliber.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Caliber.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Crossout.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Crossout.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Enlisted.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Enlisted.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Lost Ark.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Lost Ark.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ??????? ???????.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ??????? ???????.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Rail Nation.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Rail Nation.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ?????? Steam.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ?????? Steam.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ?????? Steam.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Caliber.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\War Thunder.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\War Thunder.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Warface.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Warface.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\World of Tanks.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\World of Tanks.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ??????? ???????.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\???????? ??????? ???????.lnk" 51201 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe "C:\Users\user\AppData\Local\Temp\is-F4CP3.tmp\shortcut.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\World of Warships.lnk" 5386 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LNKT1.tmp\SecuriteInfo.com.FileRepMalware.18165.2747.tmp Process created: unknown unknown Jump to behavior
Source: explorer.exe, 00000006.00000000.2190428706.00000000013A1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: IProgram Manager
Source: shortcut.exe, 00000003.00000002.2232176019.00007FF6918C1000.00000020.00000001.01000000.00000008.sdmp, shortcut.exe, 00000008.00000002.2240230221.00007FF6918C1000.00000020.00000001.01000000.00000008.sdmp, shortcut.exe, 0000000B.00000000.2244007388.00007FF6918C1000.00000020.00000001.01000000.00000008.sdmp Binary or memory string: shell32.dllProgmanTechnosys Pin To Taskbar UtilityPin To Taskbar Utility v0.99.9
Source: explorer.exe, 00000006.00000000.2190428706.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.2192028136.00000000048E0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: shortcut.exe, explorer.exe, explorer.exe, 00000006.00000000.2190428706.00000000013A1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.2189789350.0000000000D60000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: +Progman
Source: SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2054638035.0000000002430000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.18165.2747.exe, 00000000.00000003.2582891225.0000000002273000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: @@.rsrc`+`, @@shell32.dllProgmanTechnosys Pin To Taskbar UtilityPin To Taskbar Utility v0.99.9
Source: explorer.exe, 00000006.00000000.2190428706.00000000013A1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000006.00000000.2195612718.00000000098AD000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd31A
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Windows\explorer.exe Directory queried: number of queries: 1001
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1427003 Sample: SecuriteInfo.com.FileRepMal... Startdate: 16/04/2024 Architecture: WINDOWS Score: 44 47 ipinfo.io 2->47 65 Malicious sample detected (through community Yara rule) 2->65 67 Multi AV Scanner detection for submitted file 2->67 69 Windows shortcut file (LNK) contains suspicious command line arguments 2->69 9 SecuriteInfo.com.FileRepMalware.18165.2747.exe 2 2->9         started        signatures3 process4 file5 41 SecuriteInfo.com.F...ware.18165.2747.tmp, PE32 9->41 dropped 12 SecuriteInfo.com.FileRepMalware.18165.2747.tmp 26 68 9->12         started        process6 dnsIp7 49 ipinfo.io 34.117.186.192, 443, 49699 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 12->49 43 C:\Users\user\AppData\Local\...\shortcut.exe, PE32+ 12->43 dropped 45 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 12->45 dropped 16 shortcut.exe 1 12->16         started        19 shortcut.exe 12->19         started        21 shortcut.exe 12->21         started        23 26 other processes 12->23 file8 process9 signatures10 51 Contains functionality to inject threads in other processes 16->51 53 Injects code into the Windows Explorer (explorer.exe) 16->53 55 Writes to foreign memory regions 16->55 25 explorer.exe 91 157 16->25 injected 27 conhost.exe 16->27         started        57 Allocates memory in foreign processes 19->57 59 Creates a thread in another existing process (thread injection) 19->59 61 Injects a PE file into a foreign processes 19->61 29 conhost.exe 19->29         started        63 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 21->63 31 conhost.exe 21->31         started        33 conhost.exe 23->33         started        35 conhost.exe 23->35         started        37 conhost.exe 23->37         started        39 23 other processes 23->39 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.117.186.192
 ipinfo.io United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false

Contacted Domains

Name IP Active
ipinfo.io 34.117.186.192 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://ipinfo.io/country false
    		high