Windows Analysis Report
PS-CollectionTool.exe

ID:	1432291
Product:	CloudBasic
Start time:	19:41:47
Start date:	26.04.2024
Sample:	PS-CollectionTool.exe
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	32f6bb54cfc8988631e0bf97b58d68fb
SHA1:	500823dd5475d68bbb3796de17be45a41bf7c991
SHA256:	43ae07d6f62377c7439a675dc1f470845545bf0906f3b46c857bbffb157f1e63
Filetype:	Win64 Executable GUI Net Framework (217006/5) 49.88%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PS-CollectionToo_d7a32e9879581bafec6b32f9c47d3fdae71563_e01be375_7f308138-fdd4-4f72-84c7-562ec17810ce\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	007E680B1B667068517803163E72CBEE	71148C8E1B4755D6FA4DE4874689717A23D43AC1	2736B67AA6470D876A0539F47A021F47F60AFA5212EF9B1A7BB08547E92CC1D3
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A3B.tmp.dmp	Mini DuMP crash report, 16 streams, Fri Apr 26 17:42:16 2024, 0x1205a4 type	6C704F7F3CDD8DD44D35A15559794817	331B3278C54853D0EF2ECB0D16DE5E24E2917E35	54D3E6162DD990FE247903A27D55928D2A0D669188BDE76736388063A6AC2187
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B84.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	F82014CAF3CA3531C6FBC8C5F75940C3	E4614D9D269816ADF3ADD0359050C07CC72053A5	A66D97FE98268F83B4420961728BF384FF43F642D1B0F5FE96A6A883466EC104
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1BD4.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	FA8551749A4D2EE05AD69B1C1162A820	0FEEA3294CDA9D771C9413F379E8A4EFD8D27BE1	FEBEC349C49214E9F2EA08F07B1E92134311AC29399CBF505A2279882FA97985
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	0EE51C1D73D4D6987CD142B85FB04345	485624812A4567B42BCDD22C067B05A08FDC8B4B	9CE54F97049D180BA3FE4449C2E8875032668E6E4421C9477F3523E6992D886D

Compliance

Source: PS-CollectionTool.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: PresentationFramework.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: PresentationCore.ni.pdbRSDSc source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: WindowsBase.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: PS-CollectionTool.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: PS-CollectionTool.pdbMZ source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb* source: PS-CollectionTool.exe, 00000000.00000002.1187189249.0000017DA0B61000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: PresentationFramework.ni.pdbRSDS source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: D:\projects\C#\PSCollectionTool\PS-CollectionTool\obj\x64\Release\PS-CollectionTool.pdb source: PS-CollectionTool.exe
Source:	Binary string: System.Xaml.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: WindowsBase.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: PS-CollectionTool.exe, 00000000.00000002.1187189249.0000017DA0B61000.00000004.00000800.00020000.00000000.sdmp, WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdbRSDSw source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: PresentationCore.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.pdbH source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.Xaml.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdbco source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.Xaml.ni.pdbRSDS\Y source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.pdb source: PS-CollectionTool.exe, 00000000.00000002.1186616661.0000017D9F037000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: PresentationCore.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER1A3B.tmp.dmp.4.dr

Networking

Source: PS-CollectionTool.exe	String found in binary or memory: http://schemas.datacontract.org/2004/07/CT_WCF_WebRole
Source: PS-CollectionTool.exe	String found in binary or memory: http://tempuri.org/CT_IService/GetDataResponse
Source: PS-CollectionTool.exe	String found in binary or memory: http://tempuri.org/CT_IService/GetDataT
Source: PS-CollectionTool.exe	String found in binary or memory: http://tempuri.org/CT_IService/GetDataUsingDataContractResponse
Source: PS-CollectionTool.exe	String found in binary or memory: http://tempuri.org/CT_IService/GetDataUsingDataContractT
Source: PS-CollectionTool.exe	String found in binary or memory: http://tempuri.org/CT_IService/IsHostBlockedResponse
Source: PS-CollectionTool.exe	String found in binary or memory: http://tempuri.org/CT_IService/IsHostBlockedT
Source: PS-CollectionTool.exe	String found in binary or memory: http://tempuri.org/CT_IService/WriteFileDetailsResponse
Source: PS-CollectionTool.exe	String found in binary or memory: http://tempuri.org/CT_IService/WriteFileDetailsT
Source: PS-CollectionTool.exe	String found in binary or memory: http://tempuri.org/CT_IService/WriteInitialResponse
Source: PS-CollectionTool.exe	String found in binary or memory: http://tempuri.org/CT_IService/WriteInitialT
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: PS-CollectionTool.exe	String found in binary or memory: http://wpfanimatedgif.codeplex.com
Source: PS-CollectionTool.exe	String found in binary or memory: https://iceluc3.wixsite.com/smartoptimize

System Summary

Source: C:\Users\user\Desktop\PS-CollectionTool.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7152 -s 848

Source: PS-CollectionTool.exe

Static PE information: No import functions for PE file found

Source: classification engine

Classification label: clean3.winEXE@2/5@0/0

Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7152
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Mutant created: NULL

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\e7586fd3-821e-4521-bef8-c2bc47906d29

Jump to behavior

Source: PS-CollectionTool.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PS-CollectionTool.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\PS-CollectionTool.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PS-CollectionTool.exe	String found in binary or memory: Iteration 3JSON start parsing result/Loading to Dictionary:
Source: PS-CollectionTool.exe	String found in binary or memory: ipv4-address
Source: PS-CollectionTool.exe	String found in binary or memory: show-address-ranges;500;full;address-ranges.txt;Address Ranges;false;true
Source: PS-CollectionTool.exe	String found in binary or memory: 8resources/loading/border.png
Source: PS-CollectionTool.exe	String found in binary or memory: :resources/loading/loader5.gif
Source: PS-CollectionTool.exe	String found in binary or memory: <resources/loading/loading1.gif
Source: PS-CollectionTool.exe	String found in binary or memory: <resources/loading/loading2.gifQ
Source: PS-CollectionTool.exe	String found in binary or memory: <resources/loading/loading3.gif=
Source: PS-CollectionTool.exe	String found in binary or memory: <resources/loading/loading4.gif
Source: PS-CollectionTool.exe	String found in binary or memory: <resources/loading/loading5.gif]
Source: PS-CollectionTool.exe	String found in binary or memory: ../Resources/Loading/Loader5.gif

Source: unknown	Process created: C:\Users\user\Desktop\PS-CollectionTool.exe "C:\Users\user\Desktop\PS-CollectionTool.exe"
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7152 -s 848

Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Section loaded: mscoree.dll			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Section loaded: kernel.appcore.dll			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Section loaded: version.dll			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Section loaded: vcruntime140_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Section loaded: ucrtbase_clr0400.dll			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Section loaded: uxtheme.dll			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Section loaded: rsaenh.dll			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Section loaded: cryptbase.dll			Jump to behavior

Source: C:\Users\user\Desktop\PS-CollectionTool.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PS-CollectionTool.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PS-CollectionTool.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PS-CollectionTool.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: PS-CollectionTool.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: PS-CollectionTool.exe

Static file information: File size 3746816 > 1048576

Source: PS-CollectionTool.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x392400

Source: PS-CollectionTool.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: PS-CollectionTool.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: PresentationFramework.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: PresentationCore.ni.pdbRSDSc source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: WindowsBase.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: PS-CollectionTool.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: PS-CollectionTool.pdbMZ source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb* source: PS-CollectionTool.exe, 00000000.00000002.1187189249.0000017DA0B61000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: PresentationFramework.ni.pdbRSDS source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: D:\projects\C#\PSCollectionTool\PS-CollectionTool\obj\x64\Release\PS-CollectionTool.pdb source: PS-CollectionTool.exe
Source:	Binary string: System.Xaml.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: WindowsBase.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: PS-CollectionTool.exe, 00000000.00000002.1187189249.0000017DA0B61000.00000004.00000800.00020000.00000000.sdmp, WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdbRSDSw source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: PresentationCore.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.pdbH source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.Xaml.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdbco source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.Xaml.ni.pdbRSDS\Y source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.Core.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.pdb source: PS-CollectionTool.exe, 00000000.00000002.1186616661.0000017D9F037000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: PresentationCore.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WER1A3B.tmp.dmp.4.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER1A3B.tmp.dmp.4.dr

Data Obfuscation

Source: C:\Users\user\Desktop\PS-CollectionTool.exe

Code function: 0_2_00007FFEC84701BA push E95E4D4Ch; ret

0_2_00007FFEC84701C9

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Memory allocated: 17D9F230000 memory reserve | memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Memory allocated: 17DB8B60000 memory reserve | memory write watch			Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 c8 0c e4 52 1d cc-a0 8f d3 a4 82 3e 8f 04
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: PS-CollectionTool.exe	Binary or memory string: \qEmu
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Anti Debugging

Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\PS-CollectionTool.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\PS-CollectionTool.exe

Memory allocated: page read and write | page guard

Jump to behavior

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\PS-CollectionTool.exe

Queries volume information: C:\Users\user\Desktop\PS-CollectionTool.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\PS-CollectionTool.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe