Analysis Report zUEBMx2U10.exe

Overview

General Information

Sample Name: zUEBMx2U10.exe
Analysis ID: 411703
MD5: 9b2b7acc05e281c17f978028722b51e9
SHA1: 9316ff35c185dcf3c80c2c3ab2ff55ff1076652a
SHA256: 92781fa0c501e4375f625a6e8379bbe8f0d7d42fd6699981233a044222e081d4
Tags: exeNanoCoreRAT
Infos:

Most interesting Screenshot:

Detection

Nanocore
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected Nanocore Rat
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Yara detected Nanocore RAT
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Creates an autostart registry key pointing to binary in C:\Windows
Drops PE files with benign system names
Drops executables to the windows directory (C:\Windows) and starts them
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Non Interactive PowerShell
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 1.2.zUEBMx2U10.exe.6e68bb8.9.raw.unpack Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "6f656d69-7475-8807-1300-000c0a4c", "Group": "backup july", "Domain1": "backupjuly.duckdns.org", "Domain2": "backupjuly.duckdns.org", "Port": 9090, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8"}
Multi AV Scanner detection for dropped file
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Metadefender: Detection: 32% Perma Link
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe ReversingLabs: Detection: 75%
Multi AV Scanner detection for submitted file
Source: zUEBMx2U10.exe Virustotal: Detection: 42% Perma Link
Source: zUEBMx2U10.exe Metadefender: Detection: 32% Perma Link
Source: zUEBMx2U10.exe ReversingLabs: Detection: 75%
Yara detected Nanocore RAT
Source: Yara match File source: 00000001.00000002.680956480.0000000006E35000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.651427825.00000000042A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: zUEBMx2U10.exe PID: 6540, type: MEMORY
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e35d98.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e68bb8.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e68bb8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e35d98.8.raw.unpack, type: UNPACKEDPE
Machine Learning detection for dropped file
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: zUEBMx2U10.exe Joe Sandbox ML: detected
Source: zUEBMx2U10.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: rsaenh.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdb% source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdb" source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000016.00000003.423179502.00000000006BB000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: onfiguration.ni.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000016.00000003.468924392.0000000004CD0000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: System.Xml.pdbr source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: ml.pdb? source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: crypt32.pdbBS? source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: ml.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: .ni.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: clr.pdb source: WerFault.exe, 00000016.00000003.468924392.0000000004CD0000.00000004.00000040.sdmp
Source: Binary string: cryptsp.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: ility.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: c.pdbis?N source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: System.Configuration.ni.pdb% source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: wUxTheme.pdbC source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: ntmarta.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: CLBCatQ.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: urlmon.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 00000016.00000003.468962239.0000000004CD5000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: (P%pLC:\Windows\Microsoft.VisualBasic.pdb source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: System.Xml.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: System.Core.pdb" source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: dwmapi.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: mscoree.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: cryptsp.pdb`S source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: rsaenh.pdbjS source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdbT source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdbk source: WerFault.exe, 00000016.00000003.468962239.0000000004CD5000.00000004.00000040.sdmp
Source: Binary string: comctl32v582.pdbw source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdbT3|l source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: System.pdbg source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: System.Xml.ni.pdbr source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdb source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdbXS9 source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: iertutil.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: C:\Users\user\Desktop\zUEBMx2U10.PDB3 source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: msasn1.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdb source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: comctl32v582.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 00000016.00000003.468962239.0000000004CD5000.00000004.00000040.sdmp
Source: Binary string: System.Drawing.pdb source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: Windows.StateRepositoryPS.pdb% source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 00000016.00000003.419379807.0000000000690000.00000004.00000001.sdmp
Source: Binary string: System.ni.pdbT source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: Accessibility.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: mscorlib.ni.pdbr source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: Accessibility.pdbr source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: ml.ni.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdbfS source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: Accessibility.pdb source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: rawing.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: mscoreei.pdbk source: WerFault.exe, 00000016.00000003.467783632.0000000004CD1000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: t.VisualBasic.pdb source: WerFault.exe, 00000016.00000003.468505271.0000000004B76000.00000004.00000001.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000016.00000003.468924392.0000000004CD0000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb" source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: C:\Users\user\Desktop\zUEBMx2U10.PDB source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: msasn1.pdbLS% source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdbT source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: diasymreader.pdb source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: Windows.StateRepositoryPS.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: System.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: Windows.Storage.pdb% source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 00000016.00000003.423103946.0000000000684000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: cldapi.pdbM source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000016.00000003.468924392.0000000004CD0000.00000004.00000040.sdmp
Source: Binary string: np0pVisualBasic.pdb source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: WLDP.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdbT source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: .pdb(8 source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: clrjit.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: onfiguration.pdb{{ source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: zUEBMx2U10.PDBL source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: version.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: onfiguration.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: wintrust.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: System.Xml.pdb source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: System.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: iertutil.pdb3! source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: WLDP.pdb^S3 source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Windows.Forms.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000016.00000003.468924392.0000000004CD0000.00000004.00000040.sdmp
Source: Binary string: psapi.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdbTS source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: System.Windows.Forms.pdbr source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: cldapi.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000016.00000003.467783632.0000000004CD1000.00000004.00000040.sdmp
Source: Binary string: mscoreei.pdb source: WerFault.exe, 00000016.00000003.467783632.0000000004CD1000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 00000016.00000003.417934703.0000000000696000.00000004.00000001.sdmp
Source: Binary string: System.Configuration.ni.pdbr source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: System.Drawing.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: combase.pdbk source: WerFault.exe, 00000016.00000003.468962239.0000000004CD5000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Windows.Forms.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: OneCoreUAPCommonProxyStub.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000016.00000003.467783632.0000000004CD1000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdbl source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: System.ni.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: edputil.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: crypt32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: backupjuly.duckdns.org
Uses dynamic DNS services
Source: unknown DNS query: name: backupjuly.duckdns.org
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:49728 -> 185.19.85.140:9090
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DATAWIRE-ASCH DATAWIRE-ASCH
Source: svchost.exe, 0000001D.00000003.514597098.0000020C4354B000.00000004.00000001.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI", equals www.facebook.com (Facebook)
Source: svchost.exe, 0000001D.00000003.514597098.0000020C4354B000.00000004.00000001.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI", equals www.twitter.com (Twitter)
Source: svchost.exe, 0000001D.00000002.539329325.0000020C43557000.00000004.00000001.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-05-11T09:38:07.3274264Z||.||7e6d3bb3-74bc-4bd2-8463-13ea3a980d3c||1152921505693476823||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"
Source: svchost.exe, 0000001D.00000002.539329325.0000020C43557000.00000004.00000001.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-05-11T09:38:07.3274264Z||.||7e6d3bb3-74bc-4bd2-8463-13ea3a980d3c||1152921505693476823||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"
Source: svchost.exe, 0000001D.00000003.514597098.0000020C4354B000.00000004.00000001.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI",3I equals www.facebook.com (Facebook)
Source: svchost.exe, 0000001D.00000003.514597098.0000020C4354B000.00000004.00000001.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI",3I equals www.twitter.com (Twitter)
Source: svchost.exe, 0000001D.00000003.514597098.0000020C4354B000.00000004.00000001.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify Music","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE equals www.facebook.com (Facebook)
Source: svchost.exe, 0000001D.00000003.514597098.0000020C4354B000.00000004.00000001.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify Music","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE equals www.twitter.com (Twitter)
Source: svchost.exe, 0000001D.00000003.502580650.0000020C43589000.00000004.00000001.sdmp String found in binary or memory: t enough.\r\n\r\nSHARE WITH FRIENDS\r\nSend photos and videos to keep your close friends up to speed. Receive files for even more productivity.\r\n\r\n\r\n*Calls are free over Wi-Fi but otherwise standard data charges apply.\r\nPrivacy Policy: https://www.facebook.com/about/privacy | LEARN MORE at: https://messenger.com (https://messenger.com/)","ProductTitle":"Messenger","SearchTitles":[],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9WZDNCRF0083","Properties":{"PackageFamilyName":"Facebook.317180B0BB486_8xx8rvfyw5nnt","PackageIdentityName":"FACEBOOK.317180B0BB486","PublisherCertificateName":"CN=6E08453F-9BA7-4311-999C-D22FBA2FB1B8","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"c6a9fa5c-20a2-4e12-904d-edd408657dc8"},{"IdType":"LegacyWindowsPhoneProductId","Value":"3219d30d-4a23-4f58-a91c-c44b04e6a0c7"},{"IdType":"XboxTitleId","Value":"2004208728"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-04-28T14:19:25.9172986Z||.||2e8b091b-9a79-4b36-a1ad-1238cc769fa9||1152921505693355901||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku":{"LastModifiedDate":"2021-04-28T14:18:40.1620745Z","LocalizedProperties":[{"SkuDescription":"Made for big screens and close connections. Get access to free* texting, and high-quality voice & video chat built specifically for desktop.\r\n\r\nMADE FOR DESKTOP, MADE
Source: svchost.exe, 0000001D.00000003.497552515.0000020C435A6000.00000004.00000001.sdmp String found in binary or memory: % Regular free updates with loads of new content\r\n____________________________ \r\n\r\nGame available in: English, French, Italian, German, Spanish, Portuguese, Brazilian Portuguese, Russian, Korean, Simplified Chinese, Traditional Chinese, Japanese, Arabic\r\n____________________________ \r\n\r\nSign up now for a weekly round-up of the best from G5 Games! www.g5e.com/e-mail\r\n____________________________ \r\n\r\nG5 Games - World of Adventures"!!\r\nCollect them all! Search for \"g5\" in Windows Store! \r\n____________________________\r\n\r\nVISIT US: www.g5e.com\r\nWATCH US: www.youtube.com/g5enter\r\nFIND US: www.facebook.com/HiddenCityGame\r\nJOIN US: https://instagram.com/hiddencity_\r\nFOLLOW US: www.twitter.com/g5games\r\nTerms of Service: http://www.g5e.com/termsofservice \r\nG5 End User License Supplemental Terms: http://www.g5e.com/G5_End_User_License_Supplemental_Terms","ProductTitle":"Hidden City: Hidden Object Adventure","SearchTitles":[{"SearchTitleString":"find hidden objects ","SearchTitleType":"SearchHint"},{"SearchTitleString":"junes pearls free ","SearchTitleType":"SearchHint"},{"SearchTitleString":"ispy notes peril","SearchTitleType":"SearchHint"},{"SearchTitleString":"seekers mystery ","SearchTitleType":"SearchHint"},{"SearchTitleString":"detective manor solving","SearchTitleType":"SearchHint"},{"SearchTitleString":"sherlock hotel spot it","SearchTitleType":"SearchHint"},{"SearchTitleString":"puzzle game journey ","SearchTitleType":"SearchHint"}],"Language":"en","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductGame;1","ProductId":"9NBLGGH6J6VK","Properties":{"PackageFamilyName":"828B5831.HiddenCityMysteryofShadows_ytsefhwckbdv6","PackageIdentityName
Source: svchost.exe, 0000001D.00000003.497552515.0000020C435A6000.00000004.00000001.sdmp String found in binary or memory: % Regular free updates with loads of new content\r\n____________________________ \r\n\r\nGame available in: English, French, Italian, German, Spanish, Portuguese, Brazilian Portuguese, Russian, Korean, Simplified Chinese, Traditional Chinese, Japanese, Arabic\r\n____________________________ \r\n\r\nSign up now for a weekly round-up of the best from G5 Games! www.g5e.com/e-mail\r\n____________________________ \r\n\r\nG5 Games - World of Adventures"!!\r\nCollect them all! Search for \"g5\" in Windows Store! \r\n____________________________\r\n\r\nVISIT US: www.g5e.com\r\nWATCH US: www.youtube.com/g5enter\r\nFIND US: www.facebook.com/HiddenCityGame\r\nJOIN US: https://instagram.com/hiddencity_\r\nFOLLOW US: www.twitter.com/g5games\r\nTerms of Service: http://www.g5e.com/termsofservice \r\nG5 End User License Supplemental Terms: http://www.g5e.com/G5_End_User_License_Supplemental_Terms","ProductTitle":"Hidden City: Hidden Object Adventure","SearchTitles":[{"SearchTitleString":"find hidden objects ","SearchTitleType":"SearchHint"},{"SearchTitleString":"junes pearls free ","SearchTitleType":"SearchHint"},{"SearchTitleString":"ispy notes peril","SearchTitleType":"SearchHint"},{"SearchTitleString":"seekers mystery ","SearchTitleType":"SearchHint"},{"SearchTitleString":"detective manor solving","SearchTitleType":"SearchHint"},{"SearchTitleString":"sherlock hotel spot it","SearchTitleType":"SearchHint"},{"SearchTitleString":"puzzle game journey ","SearchTitleType":"SearchHint"}],"Language":"en","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductGame;1","ProductId":"9NBLGGH6J6VK","Properties":{"PackageFamilyName":"828B5831.HiddenCityMysteryofShadows_ytsefhwckbdv6","PackageIdentityName
Source: svchost.exe, 0000001D.00000003.497552515.0000020C435A6000.00000004.00000001.sdmp String found in binary or memory: % Regular free updates with loads of new content\r\n____________________________ \r\n\r\nGame available in: English, French, Italian, German, Spanish, Portuguese, Brazilian Portuguese, Russian, Korean, Simplified Chinese, Traditional Chinese, Japanese, Arabic\r\n____________________________ \r\n\r\nSign up now for a weekly round-up of the best from G5 Games! www.g5e.com/e-mail\r\n____________________________ \r\n\r\nG5 Games - World of Adventures"!!\r\nCollect them all! Search for \"g5\" in Windows Store! \r\n____________________________\r\n\r\nVISIT US: www.g5e.com\r\nWATCH US: www.youtube.com/g5enter\r\nFIND US: www.facebook.com/HiddenCityGame\r\nJOIN US: https://instagram.com/hiddencity_\r\nFOLLOW US: www.twitter.com/g5games\r\nTerms of Service: http://www.g5e.com/termsofservice \r\nG5 End User License Supplemental Terms: http://www.g5e.com/G5_End_User_License_Supplemental_Terms","ProductTitle":"Hidden City: Hidden Object Adventure","SearchTitles":[{"SearchTitleString":"find hidden objects ","SearchTitleType":"SearchHint"},{"SearchTitleString":"junes pearls free ","SearchTitleType":"SearchHint"},{"SearchTitleString":"ispy notes peril","SearchTitleType":"SearchHint"},{"SearchTitleString":"seekers mystery ","SearchTitleType":"SearchHint"},{"SearchTitleString":"detective manor solving","SearchTitleType":"SearchHint"},{"SearchTitleString":"sherlock hotel spot it","SearchTitleType":"SearchHint"},{"SearchTitleString":"puzzle game journey ","SearchTitleType":"SearchHint"}],"Language":"en","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductGame;1","ProductId":"9NBLGGH6J6VK","Properties":{"PackageFamilyName":"828B5831.HiddenCityMysteryofShadows_ytsefhwckbdv6","PackageIdentityName
Source: svchost.exe, 0000001D.00000003.502624263.0000020C4356A000.00000004.00000001.sdmp String found in binary or memory: t enough.\r\n\r\nSHARE WITH FRIENDS\r\nSend photos and videos to keep your close friends up to speed. Receive files for even more productivity.\r\n\r\n\r\n*Calls are free over Wi-Fi but otherwise standard data charges apply.\r\nPrivacy Policy: https://www.facebook.com/about/privacy | LEARN MORE at: https://messenger.com (https://messenger.com/)","ProductTitle":"Messenger","SearchTitles":[],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9WZDNCRF0083","Properties":{"PackageFamilyName":"Facebook.317180B0BB486_8xx8rvfyw5nnt","PackageIdentityName":"FACEBOOK.317180B0BB486","PublisherCertificateName":"CN=6E08453F-9BA7-4311-999C-D22FBA2FB1B8","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"c6a9fa5c-20a2-4e12-904d-edd408657dc8"},{"IdType":"LegacyWindowsPhoneProductId","Value":"3219d30d-4a23-4f58-a91c-c44b04e6a0c7"},{"IdType":"XboxTitleId","Value":"2004208728"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-04-28T14:19:25.9172986Z||.||2e8b091b-9a79-4b36-a1ad-1238cc769fa9||1152921505693355901||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku":{"LastModifiedDate":"2021-04-28T14:18:40.1620745Z","LocalizedProperties":[{"SkuDescription":"Made for big screens and close connections. Get access to free* texting, and high-quality voice & video chat built specifically for desktop.\r\n\r\nMADE FOR DESKTOP, MADE
Source: unknown DNS traffic detected: queries for: backupjuly.duckdns.org
Source: svchost.exe, 0000001D.00000002.531282040.0000020C42CAA000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: svchost.exe, 0000001D.00000002.531282040.0000020C42CAA000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: svchost.exe, 0000001D.00000002.531282040.0000020C42CAA000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: svchost.exe, 0000001D.00000002.531282040.0000020C42CAA000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: powershell.exe, 00000007.00000003.496753193.0000000007457000.00000004.00000001.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
Source: WerFault.exe, 00000016.00000003.457240955.0000000004EA0000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o
Source: powershell.exe, 00000007.00000003.496753193.0000000007457000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: svchost.exe, 0000001D.00000003.497552515.0000020C435A6000.00000004.00000001.sdmp String found in binary or memory: http://www.g5e.com/G5_End_User_License_Supplemental_Terms
Source: svchost.exe, 0000001D.00000003.497552515.0000020C435A6000.00000004.00000001.sdmp String found in binary or memory: http://www.g5e.com/termsofservice
Source: svchost.exe, 0000001D.00000003.512531285.0000020C43573000.00000004.00000001.sdmp, svchost.exe, 0000001D.00000003.512818639.0000020C4358F000.00000004.00000001.sdmp String found in binary or memory: https://corp.roblox.com/contact/
Source: svchost.exe, 0000001D.00000003.512531285.0000020C43573000.00000004.00000001.sdmp, svchost.exe, 0000001D.00000003.512818639.0000020C4358F000.00000004.00000001.sdmp String found in binary or memory: https://corp.roblox.com/parents/
Source: svchost.exe, 0000001D.00000003.512531285.0000020C43573000.00000004.00000001.sdmp, svchost.exe, 0000001D.00000003.512818639.0000020C4358F000.00000004.00000001.sdmp String found in binary or memory: https://en.help.roblox.com/hc/en-us
Source: powershell.exe, 00000007.00000003.496753193.0000000007457000.00000004.00000001.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000003.486985985.0000000005A9B000.00000004.00000001.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 00000007.00000003.507167541.0000000004D32000.00000004.00000001.sdmp String found in binary or memory: https://go.microd
Source: svchost.exe, 0000001D.00000003.497552515.0000020C435A6000.00000004.00000001.sdmp String found in binary or memory: https://instagram.com/hiddencity_
Source: svchost.exe, 0000001D.00000003.512531285.0000020C43573000.00000004.00000001.sdmp, svchost.exe, 0000001D.00000003.512818639.0000020C4358F000.00000004.00000001.sdmp String found in binary or memory: https://www.roblox.com/develop
Source: svchost.exe, 0000001D.00000003.512531285.0000020C43573000.00000004.00000001.sdmp, svchost.exe, 0000001D.00000003.512818639.0000020C4358F000.00000004.00000001.sdmp String found in binary or memory: https://www.roblox.com/info/privacy

E-Banking Fraud:

barindex
Yara detected Nanocore RAT
Source: Yara match File source: 00000001.00000002.680956480.0000000006E35000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.651427825.00000000042A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: zUEBMx2U10.exe PID: 6540, type: MEMORY
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e35d98.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e68bb8.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e68bb8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e35d98.8.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000001.00000002.680956480.0000000006E35000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.680956480.0000000006E35000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.651427825.00000000042A1000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.651427825.00000000042A1000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: zUEBMx2U10.exe PID: 6540, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: zUEBMx2U10.exe PID: 6540, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.zUEBMx2U10.exe.6e35d98.8.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.zUEBMx2U10.exe.6e35d98.8.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.zUEBMx2U10.exe.6e68bb8.9.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.zUEBMx2U10.exe.6e68bb8.9.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.zUEBMx2U10.exe.6e68bb8.9.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.zUEBMx2U10.exe.6e68bb8.9.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.zUEBMx2U10.exe.6e35d98.8.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.zUEBMx2U10.exe.6e35d98.8.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
.NET source code contains very large strings
Source: zUEBMx2U10.exe, ??????????????????????????????????.cs Long String: Length: 1923462
Source: svchost.exe.1.dr, ??????????????????????????????????.cs Long String: Length: 1923462
Source: 1.2.zUEBMx2U10.exe.bc0000.0.unpack, ??????????????????????????????????.cs Long String: Length: 1923462
Source: 1.0.zUEBMx2U10.exe.bc0000.0.unpack, ??????????????????????????????????.cs Long String: Length: 1923462
Source: 12.2.zUEBMx2U10.exe.330000.0.unpack, ??????????????????????????????????.cs Long String: Length: 1923462
Source: 12.0.zUEBMx2U10.exe.330000.0.unpack, ??????????????????????????????????.cs Long String: Length: 1923462
Source: 13.0.svchost.exe.a60000.0.unpack, ??????????????????????????????????.cs Long String: Length: 1923462
Source: 15.2.zUEBMx2U10.exe.1e0000.0.unpack, ??????????????????????????????????.cs Long String: Length: 1923462
Source: 15.0.zUEBMx2U10.exe.1e0000.0.unpack, ??????????????????????????????????.cs Long String: Length: 1923462
Source: 17.0.zUEBMx2U10.exe.ed0000.0.unpack, ??????????????????????????????????.cs Long String: Length: 1923462
Source: 18.0.svchost.exe.b30000.0.unpack, ??????????????????????????????????.cs Long String: Length: 1923462
Creates files inside the system directory
Source: C:\Users\user\Desktop\zUEBMx2U10.exe File created: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6 Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Code function: 1_2_017BA388 1_2_017BA388
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Code function: 1_2_017B0490 1_2_017B0490
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Code function: 1_2_017B2BD8 1_2_017B2BD8
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Code function: 1_2_017B3B75 1_2_017B3B75
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Code function: 1_2_017BA379 1_2_017BA379
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Code function: 1_2_017BA46E 1_2_017BA46E
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Code function: 1_2_017BA4BA 1_2_017BA4BA
One or more processes crash
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6540 -ip 6540
Sample file is different than original file name gathered from version info
Source: zUEBMx2U10.exe Binary or memory string: OriginalFilename vs zUEBMx2U10.exe
Source: zUEBMx2U10.exe, 00000001.00000002.679374835.0000000006CD1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameRunPeBraba.dll6 vs zUEBMx2U10.exe
Source: zUEBMx2U10.exe, 00000001.00000002.673906551.00000000066F0000.00000002.00000001.sdmp Binary or memory string: System.OriginalFileName vs zUEBMx2U10.exe
Source: zUEBMx2U10.exe, 00000001.00000002.675804424.0000000006950000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs zUEBMx2U10.exe
Source: zUEBMx2U10.exe, 00000001.00000002.680956480.0000000006E35000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameXKEQ OAu.exe2 vs zUEBMx2U10.exe
Source: zUEBMx2U10.exe, 00000001.00000002.570270331.0000000000BC2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirstoftheday.exe< vs zUEBMx2U10.exe
Source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs zUEBMx2U10.exe
Source: zUEBMx2U10.exe Binary or memory string: OriginalFilename vs zUEBMx2U10.exe
Source: zUEBMx2U10.exe, 0000000C.00000002.382637639.0000000000332000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirstoftheday.exe< vs zUEBMx2U10.exe
Source: zUEBMx2U10.exe Binary or memory string: OriginalFilename vs zUEBMx2U10.exe
Source: zUEBMx2U10.exe, 0000000F.00000002.391819204.00000000001E2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirstoftheday.exe< vs zUEBMx2U10.exe
Source: zUEBMx2U10.exe, 00000011.00000000.393907451.0000000000ED2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamefirstoftheday.exe< vs zUEBMx2U10.exe
Yara signature match
Source: 00000001.00000002.680956480.0000000006E35000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.680956480.0000000006E35000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.651427825.00000000042A1000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.651427825.00000000042A1000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: zUEBMx2U10.exe PID: 6540, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: zUEBMx2U10.exe PID: 6540, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.zUEBMx2U10.exe.6e35d98.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.zUEBMx2U10.exe.6e35d98.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.zUEBMx2U10.exe.6e35d98.8.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.zUEBMx2U10.exe.6e68bb8.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.zUEBMx2U10.exe.6e68bb8.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.zUEBMx2U10.exe.6e68bb8.9.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.zUEBMx2U10.exe.6e68bb8.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.zUEBMx2U10.exe.6e68bb8.9.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.zUEBMx2U10.exe.6e35d98.8.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.zUEBMx2U10.exe.6e35d98.8.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: classification engine Classification label: mal100.troj.evad.winEXE@48/28@11/3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Documents\20210512\PowerShell_transcript.760639.6iHHi+Z_.20210512052205.txt Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6540
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{0a7e289c-1b29-4584-8e36-a27a2b9592bf}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6776:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6940:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4264:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7044:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6844:120:WilError_01
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uludn5pk.srf.ps1 Jump to behavior
Source: zUEBMx2U10.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\zUEBMx2U10.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: zUEBMx2U10.exe Virustotal: Detection: 42%
Source: zUEBMx2U10.exe Metadefender: Detection: 32%
Source: zUEBMx2U10.exe ReversingLabs: Detection: 75%
Source: C:\Users\user\Desktop\zUEBMx2U10.exe File read: C:\Users\user\Desktop\zUEBMx2U10.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\zUEBMx2U10.exe 'C:\Users\user\Desktop\zUEBMx2U10.exe'
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\zUEBMx2U10.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Users\user\Desktop\zUEBMx2U10.exe C:\Users\user\Desktop\zUEBMx2U10.exe
Source: unknown Process created: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe'
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Users\user\Desktop\zUEBMx2U10.exe C:\Users\user\Desktop\zUEBMx2U10.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Users\user\Desktop\zUEBMx2U10.exe C:\Users\user\Desktop\zUEBMx2U10.exe
Source: unknown Process created: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe'
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6540 -ip 6540
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 1760
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\zUEBMx2U10.exe' -Force Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1 Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Users\user\Desktop\zUEBMx2U10.exe C:\Users\user\Desktop\zUEBMx2U10.exe Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Users\user\Desktop\zUEBMx2U10.exe C:\Users\user\Desktop\zUEBMx2U10.exe Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Users\user\Desktop\zUEBMx2U10.exe C:\Users\user\Desktop\zUEBMx2U10.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: unknown unknown
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: unknown unknown
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: unknown unknown
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6540 -ip 6540
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 1760
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\zUEBMx2U10.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: zUEBMx2U10.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: zUEBMx2U10.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: zUEBMx2U10.exe Static file information: File size 3858432 > 1048576
Source: zUEBMx2U10.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x3ad600
Source: zUEBMx2U10.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: rsaenh.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdb% source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdb" source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000016.00000003.423179502.00000000006BB000.00000004.00000001.sdmp
Source: Binary string: bcrypt.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: onfiguration.ni.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000016.00000003.468924392.0000000004CD0000.00000004.00000040.sdmp
Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: System.Xml.pdbr source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: ml.pdb? source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: crypt32.pdbBS? source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: ml.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: .ni.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: clr.pdb source: WerFault.exe, 00000016.00000003.468924392.0000000004CD0000.00000004.00000040.sdmp
Source: Binary string: cryptsp.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: ility.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: advapi32.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: wsspicli.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: c.pdbis?N source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: System.Configuration.ni.pdb% source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: wUxTheme.pdbC source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: ntmarta.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: CLBCatQ.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: urlmon.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: shlwapi.pdb source: WerFault.exe, 00000016.00000003.468962239.0000000004CD5000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: (P%pLC:\Windows\Microsoft.VisualBasic.pdb source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: System.Xml.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: System.Core.pdb" source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: dwmapi.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: mscoree.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: cryptsp.pdb`S source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: rsaenh.pdbjS source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdbT source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: shlwapi.pdbk source: WerFault.exe, 00000016.00000003.468962239.0000000004CD5000.00000004.00000040.sdmp
Source: Binary string: comctl32v582.pdbw source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: System.ni.pdbT3|l source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: System.pdbg source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: System.Xml.ni.pdbr source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: powrprof.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.pdb source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: ole32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdbXS9 source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: iertutil.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: mscorlib.ni.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: C:\Users\user\Desktop\zUEBMx2U10.PDB3 source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: msasn1.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdb source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: comctl32v582.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: combase.pdb source: WerFault.exe, 00000016.00000003.468962239.0000000004CD5000.00000004.00000040.sdmp
Source: Binary string: System.Drawing.pdb source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: Windows.StateRepositoryPS.pdb% source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: wkernel32.pdb( source: WerFault.exe, 00000016.00000003.419379807.0000000000690000.00000004.00000001.sdmp
Source: Binary string: System.ni.pdbT source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: Accessibility.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: apphelp.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: mscorlib.ni.pdbr source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: Accessibility.pdbr source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: ml.ni.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: WinTypes.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: cfgmgr32.pdbfS source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: Accessibility.pdb source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: rawing.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: mscoreei.pdbk source: WerFault.exe, 00000016.00000003.467783632.0000000004CD1000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: t.VisualBasic.pdb source: WerFault.exe, 00000016.00000003.468505271.0000000004B76000.00000004.00000001.sdmp
Source: Binary string: shcore.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000016.00000003.468924392.0000000004CD0000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb" source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: fltLib.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: C:\Users\user\Desktop\zUEBMx2U10.PDB source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: shell32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Core.ni.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: msasn1.pdbLS% source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: wimm32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdbT source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: diasymreader.pdb source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: wUxTheme.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: Windows.StateRepositoryPS.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: System.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: Windows.Storage.pdb% source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: wntdll.pdb( source: WerFault.exe, 00000016.00000003.423103946.0000000000684000.00000004.00000001.sdmp
Source: Binary string: profapi.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Xml.ni.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: cldapi.pdbM source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000016.00000003.468924392.0000000004CD0000.00000004.00000040.sdmp
Source: Binary string: np0pVisualBasic.pdb source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: WLDP.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdbT source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: .pdb(8 source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: sechost.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: clrjit.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: propsys.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: onfiguration.pdb{{ source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: zUEBMx2U10.PDBL source: zUEBMx2U10.exe, 00000001.00000002.586578171.0000000001337000.00000004.00000001.sdmp
Source: Binary string: version.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: onfiguration.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: wintrust.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: System.Xml.pdb source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: System.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: iertutil.pdb3! source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: WLDP.pdb^S3 source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Windows.Forms.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000016.00000003.468924392.0000000004CD0000.00000004.00000040.sdmp
Source: Binary string: psapi.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: bcrypt.pdbTS source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: System.Windows.Forms.pdbr source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: cldapi.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000016.00000003.467783632.0000000004CD1000.00000004.00000040.sdmp
Source: Binary string: mscoreei.pdb source: WerFault.exe, 00000016.00000003.467783632.0000000004CD1000.00000004.00000040.sdmp
Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 00000016.00000003.417934703.0000000000696000.00000004.00000001.sdmp
Source: Binary string: System.Configuration.ni.pdbr source: WerFault.exe, 00000016.00000003.467650722.0000000004CE8000.00000004.00000040.sdmp
Source: Binary string: System.Drawing.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: combase.pdbk source: WerFault.exe, 00000016.00000003.468962239.0000000004CD5000.00000004.00000040.sdmp
Source: Binary string: System.Core.pdb source: WerFault.exe, 00000016.00000003.468054120.0000000004CE9000.00000004.00000001.sdmp
Source: Binary string: oleaut32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: System.Windows.Forms.pdbx source: WerFault.exe, 00000016.00000002.560868292.0000000004E60000.00000004.00000001.sdmp
Source: Binary string: OneCoreUAPCommonProxyStub.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000016.00000003.467783632.0000000004CD1000.00000004.00000040.sdmp
Source: Binary string: wuser32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp
Source: Binary string: cryptbase.pdbl source: WerFault.exe, 00000016.00000003.468171677.0000000004B61000.00000004.00000001.sdmp
Source: Binary string: System.ni.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: edputil.pdb source: WerFault.exe, 00000016.00000003.467450997.0000000004CDC000.00000004.00000040.sdmp
Source: Binary string: crypt32.pdb source: WerFault.exe, 00000016.00000003.468999733.0000000004CD8000.00000004.00000040.sdmp

Data Obfuscation:

barindex
Binary contains a suspicious time stamp
Source: zUEBMx2U10.exe Static PE information: 0x8236B8BB [Fri Mar 25 00:05:15 2039 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Code function: 1_2_017B52C9 push eax; iretd 1_2_017B56A1

Persistence and Installation Behavior:

barindex
Drops PE files with benign system names
Source: C:\Users\user\Desktop\zUEBMx2U10.exe File created: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Jump to dropped file
Drops executables to the windows directory (C:\Windows) and starts them
Source: unknown Executable created and started: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe
Drops PE files
Source: C:\Users\user\Desktop\zUEBMx2U10.exe File created: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\Desktop\zUEBMx2U10.exe File created: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Jump to dropped file

Boot Survival:

barindex
Creates an autostart registry key pointing to binary in C:\Windows
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce 9EO342rLb92o62 Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce 9EO342rLb92o62 Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce 9EO342rLb92o62 Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce 9EO342rLb92o62 Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce 9EO342rLb92o62 Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\zUEBMx2U10.exe File opened: C:\Users\user\Desktop\zUEBMx2U10.exe:Zone.Identifier read attributes | delete
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Tries to delay execution (extensive OutputDebugStringW loop)
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Section loaded: OutputDebugStringW count: 230
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Section loaded: OutputDebugStringW count: 115
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: zUEBMx2U10.exe, 00000001.00000002.679374835.0000000006CD1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.442695324.0000000005590000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL/WINE_GET_UNIX_FILE_NAMEQEMU
Source: zUEBMx2U10.exe, 00000001.00000002.679374835.0000000006CD1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.442695324.0000000005590000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLLUSER
Contains capabilities to detect virtual machines
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4399 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2573 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4699
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2451
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4271
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2810
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Window / User API: threadDelayed 3437
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Window / User API: threadDelayed 5550
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Window / User API: foregroundWindowGot 547
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1971
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 626
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\zUEBMx2U10.exe TID: 6544 Thread sleep count: 100 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3912 Thread sleep time: -27670116110564310s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3912 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6976 Thread sleep count: 4699 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6980 Thread sleep count: 2451 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7136 Thread sleep count: 57 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6232 Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6232 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6356 Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6356 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe TID: 6260 Thread sleep count: 100 > 30
Source: C:\Users\user\Desktop\zUEBMx2U10.exe TID: 7104 Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe TID: 6472 Thread sleep count: 100 > 30
Source: C:\Windows\System32\svchost.exe TID: 4760 Thread sleep time: -210000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 492 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2988 Thread sleep count: 207 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2988 Thread sleep count: 65 > 30
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread delayed: delay time: 922337203685477
Source: WerFault.exe, 00000016.00000003.442695324.0000000005590000.00000004.00000001.sdmp Binary or memory string: !noValueButYesKeySC:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: powershell.exe, 00000003.00000003.625601350.0000000005172000.00000004.00000001.sdmp, powershell.exe, 00000005.00000003.608755342.00000000058E1000.00000004.00000001.sdmp Binary or memory string: Hyper-V
Source: WerFault.exe, 00000016.00000003.442695324.0000000005590000.00000004.00000001.sdmp Binary or memory string: VMWAREESOFTWARE\VMware, Inc.\VMware Tools
Source: svchost.exe, 00000002.00000002.349803562.0000022522F40000.00000002.00000001.sdmp, svchost.exe, 00000010.00000002.423781311.000001E135F40000.00000002.00000001.sdmp, WerFault.exe, 00000016.00000002.549548050.0000000004960000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.466257929.0000024F4D140000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 00000016.00000003.442695324.0000000005590000.00000004.00000001.sdmp Binary or memory string: vmware
Source: zUEBMx2U10.exe, 00000011.00000003.436168609.0000000001A50000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll|
Source: WerFault.exe, 00000016.00000002.547586254.0000000004678000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW(Fx
Source: WerFault.exe, 00000016.00000002.548752130.0000000004780000.00000004.00000001.sdmp, svchost.exe, 0000001D.00000002.530637699.0000020C42C80000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: zUEBMx2U10.exe, 00000001.00000002.679374835.0000000006CD1000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.442695324.0000000005590000.00000004.00000001.sdmp Binary or memory string: kernel32.dll/wine_get_unix_file_nameQEMU
Source: svchost.exe, 00000002.00000002.349803562.0000022522F40000.00000002.00000001.sdmp, svchost.exe, 00000010.00000002.423781311.000001E135F40000.00000002.00000001.sdmp, WerFault.exe, 00000016.00000002.549548050.0000000004960000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.466257929.0000024F4D140000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: svchost.exe, 00000002.00000002.349803562.0000022522F40000.00000002.00000001.sdmp, svchost.exe, 00000010.00000002.423781311.000001E135F40000.00000002.00000001.sdmp, WerFault.exe, 00000016.00000002.549548050.0000000004960000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.466257929.0000024F4D140000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 00000016.00000003.442695324.0000000005590000.00000004.00000001.sdmp Binary or memory string: VMwareVBox
Source: WerFault.exe, 00000016.00000003.442695324.0000000005590000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: WerFault.exe, 00000016.00000003.442695324.0000000005590000.00000004.00000001.sdmp Binary or memory string: InstallPathKC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\OC:\WINDOWS\system32\drivers\vmmouse.sysMC:\WINDOWS\system32\drivers\vmhgfs.sys
Source: svchost.exe, 0000001D.00000002.532108002.0000020C42CD6000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAWos
Source: svchost.exe, 00000002.00000002.349803562.0000022522F40000.00000002.00000001.sdmp, svchost.exe, 00000010.00000002.423781311.000001E135F40000.00000002.00000001.sdmp, WerFault.exe, 00000016.00000002.549548050.0000000004960000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.466257929.0000024F4D140000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: powershell.exe, 00000003.00000003.625601350.0000000005172000.00000004.00000001.sdmp, powershell.exe, 00000005.00000003.608755342.00000000058E1000.00000004.00000001.sdmp Binary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe System information queried: CodeIntegrityInformation
Hides threads from debuggers
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Thread information set: HideFromDebugger
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process queried: DebugPort
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process queried: DebugPort
Enables debug privileges
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process token adjusted: Debug
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\zUEBMx2U10.exe' -Force
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\zUEBMx2U10.exe' -Force Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force Jump to behavior
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Memory written: C:\Users\user\Desktop\zUEBMx2U10.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Memory written: unknown base: 400000 value starts with: 4D5A
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Memory written: unknown base: 400000 value starts with: 4D5A
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\zUEBMx2U10.exe' -Force Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1 Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Users\user\Desktop\zUEBMx2U10.exe C:\Users\user\Desktop\zUEBMx2U10.exe Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Users\user\Desktop\zUEBMx2U10.exe C:\Users\user\Desktop\zUEBMx2U10.exe Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Process created: C:\Users\user\Desktop\zUEBMx2U10.exe C:\Users\user\Desktop\zUEBMx2U10.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe' -Force
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: unknown unknown
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: unknown unknown
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: unknown unknown
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6540 -ip 6540
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 1760
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Queries volume information: C:\Users\user\Desktop\zUEBMx2U10.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Queries volume information: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe VolumeInformation
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Queries volume information: C:\Users\user\Desktop\zUEBMx2U10.exe VolumeInformation
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Queries volume information: unknown VolumeInformation
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Queries volume information: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe VolumeInformation
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Resources\Themes\n24d78b7bgh77OZ2K111tT4aUZ16c1FC8fLd3d31Nr6\svchost.exe Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: unknown VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: unknown VolumeInformation
Source: C:\Users\user\Desktop\zUEBMx2U10.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Nanocore RAT
Source: Yara match File source: 00000001.00000002.680956480.0000000006E35000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.651427825.00000000042A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: zUEBMx2U10.exe PID: 6540, type: MEMORY
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e35d98.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e68bb8.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e68bb8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e35d98.8.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Detected Nanocore Rat
Source: zUEBMx2U10.exe, 00000001.00000002.680956480.0000000006E35000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Yara detected Nanocore RAT
Source: Yara match File source: 00000001.00000002.680956480.0000000006E35000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.651427825.00000000042A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: zUEBMx2U10.exe PID: 6540, type: MEMORY
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e35d98.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e68bb8.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e68bb8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.zUEBMx2U10.exe.6e35d98.8.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 411703 Sample: zUEBMx2U10.exe Startdate: 12/05/2021 Architecture: WINDOWS Score: 100 60 backupjuly.duckdns.org 2->60 66 Found malware configuration 2->66 68 Malicious sample detected (through community Yara rule) 2->68 70 Multi AV Scanner detection for submitted file 2->70 72 9 other signatures 2->72 8 zUEBMx2U10.exe 3 6 2->8         started        12 svchost.exe 2->12         started        14 svchost.exe 2->14         started        16 6 other processes 2->16 signatures3 process4 dnsIp5 54 C:\Windows\Resources\Themes\...\svchost.exe, PE32 8->54 dropped 56 C:\Windows\...\svchost.exe:Zone.Identifier, ASCII 8->56 dropped 78 Creates an autostart registry key pointing to binary in C:\Windows 8->78 80 Adds a directory exclusion to Windows Defender 8->80 82 Tries to delay execution (extensive OutputDebugStringW loop) 8->82 84 Drops PE files with benign system names 8->84 19 zUEBMx2U10.exe 8->19         started        24 WerFault.exe 8->24         started        26 cmd.exe 8->26         started        34 5 other processes 8->34 86 Multi AV Scanner detection for dropped file 12->86 88 Machine Learning detection for dropped file 12->88 90 Hides threads from debuggers 12->90 28 powershell.exe 12->28         started        30 powershell.exe 12->30         started        92 Injects a PE file into a foreign processes 14->92 58 127.0.0.1 unknown unknown 16->58 32 WerFault.exe 16->32         started        file6 signatures7 process8 dnsIp9 62 backupjuly.duckdns.org 185.19.85.140, 49728, 49729, 49730 DATAWIRE-ASCH Switzerland 19->62 64 192.168.2.1 unknown unknown 19->64 50 C:\Users\user\AppData\Roaming\...\run.dat, data 19->50 dropped 74 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->74 52 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 24->52 dropped 36 conhost.exe 26->36         started        38 timeout.exe 26->38         started        76 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 28->76 40 conhost.exe 28->40         started        42 conhost.exe 30->42         started        44 conhost.exe 34->44         started        46 conhost.exe 34->46         started        48 conhost.exe 34->48         started        file10 signatures11 process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.19.85.140
 backupjuly.duckdns.org Switzerland
48971 DATAWIRE-ASCH true

Private
IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
backupjuly.duckdns.org 185.19.85.140 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
backupjuly.duckdns.org true
  • Avira URL Cloud: safe
 unknown