Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report 5nXX3v5zWn

Overview

General Information

Sample Name:5nXX3v5zWn (renamed file extension from none to exe)
Analysis ID:448478
MD5:e35a0bdb66b37b80c51a1559058e326b
SHA1:42d31ffa8a8a38d5073220550cae44d3e91bf9d6
SHA256:4d16ac850f443e678e5cdc8c104f9369a97e8347c3a64f3fce173329072fee53
Tags:32exe
Infos:

Most interesting Screenshot:

Detection

HawkEye MailPassView
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected HawkEye Rat
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected HawkEye Keylogger
Yara detected MailPassView
Adds a directory exclusion to Windows Defender
Changes the view of files in windows explorer (hidden files and folders)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses process hollowing technique
Sigma detected: Powershell Defender Exclusion
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected WebBrowserPassView password recovery tool
AV process strings found (often used to terminate AV products)
Antivirus or Machine Learning detection for unpacked file
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to detect virtual machines (SLDT)
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops certificate files (DER)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Stores large binary data to the registry
Tries to load missing DLLs
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • 5nXX3v5zWn.exe (PID: 3440 cmdline: 'C:\Users\user\Desktop\5nXX3v5zWn.exe' MD5: E35A0BDB66B37B80C51A1559058E326B)
    • powershell.exe (PID: 4116 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\5nXX3v5zWn.exe' MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 3876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 5796 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe' MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • schtasks.exe (PID: 4420 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\egGZqtIOrEmq' /XML 'C:\Users\user\AppData\Local\Temp\tmpA9C5.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 5620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 2396 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe' MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 2428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • 5nXX3v5zWn.exe (PID: 5712 cmdline: C:\Users\user\Desktop\5nXX3v5zWn.exe MD5: E35A0BDB66B37B80C51A1559058E326B)
    • 5nXX3v5zWn.exe (PID: 3708 cmdline: C:\Users\user\Desktop\5nXX3v5zWn.exe MD5: E35A0BDB66B37B80C51A1559058E326B)
      • vbc.exe (PID: 2440 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)
      • vbc.exe (PID: 5356 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt' MD5: C63ED21D5706A527419C9FBD730FFB2E)
  • WindowsUpdate.exe (PID: 5096 cmdline: 'C:\Users\user\AppData\Roaming\WindowsUpdate.exe' MD5: E35A0BDB66B37B80C51A1559058E326B)
  • WindowsUpdate.exe (PID: 3412 cmdline: 'C:\Users\user\AppData\Roaming\WindowsUpdate.exe' MD5: E35A0BDB66B37B80C51A1559058E326B)
  • cleanup

Malware Configuration

Threatname: HawkEye

{"Modules": ["mailpv", "WebBrowserPassView"], "Version": ""}

Yara Overview

Sigma Overview

System Summary:

barindex
Sigma detected: Powershell Defender ExclusionShow sources
Source: Process startedAuthor: Florian Roth: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\5nXX3v5zWn.exe', CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\5nXX3v5zWn.exe', CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Users\user\Desktop\5nXX3v5zWn.exe' , ParentImage: C:\Users\user\Desktop\5nXX3v5zWn.exe, ParentProcessId: 3440, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\5nXX3v5zWn.exe', ProcessId: 4116
Sigma detected: Non Interactive PowerShellShow sources
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\5nXX3v5zWn.exe', CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\5nXX3v5zWn.exe', CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Users\user\Desktop\5nXX3v5zWn.exe' , ParentImage: C:\Users\user\Desktop\5nXX3v5zWn.exe, ParentProcessId: 3440, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\5nXX3v5zWn.exe', ProcessId: 4116

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Found malware configurationShow sources
Source: 5nXX3v5zWn.exe.3708.17.memstrMalware Configuration Extractor: HawkEye {"Modules": ["mailpv", "WebBrowserPassView"], "Version": ""}
Multi AV Scanner detection for dropped fileShow sources
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeReversingLabs: Detection: 43%
Source: C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exeReversingLabs: Detection: 43%
Multi AV Scanner detection for submitted fileShow sources
Source: 5nXX3v5zWn.exeVirustotal: Detection: 46%Perma Link
Machine Learning detection for dropped fileShow sources
Source: C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exeJoe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeJoe Sandbox ML: detected
Machine Learning detection for sampleShow sources
Source: 5nXX3v5zWn.exeJoe Sandbox ML: detected
Source: 17.2.5nXX3v5zWn.exe.400000.0.unpackAvira: Label: TR/AD.MExecute.lzrac
Source: 17.2.5nXX3v5zWn.exe.400000.0.unpackAvira: Label: SPR/Tool.MailPassView.473
Source: 5nXX3v5zWn.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: 5nXX3v5zWn.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: 5nXX3v5zWn.exe, 00000011.00000002.506900664.0000000003321000.00000004.00000001.sdmp
Source: Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: vbc.exe
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 4x nop then jmp 0572A630h
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 4x nop then jmp 0572A630h
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 4x nop then lea esp, dword ptr [ebp-08h]
Source: global trafficTCP traffic: 192.168.2.3:49736 -> 185.26.106.194:587
Source: Joe Sandbox ViewIP Address: 91.199.212.52 91.199.212.52
Source: global trafficTCP traffic: 192.168.2.3:49736 -> 185.26.106.194:587
Source: global trafficHTTP traffic detected: GET /SectigoRSADomainValidationSecureServerCA.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: crt.sectigo.com
Source: vbc.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: unknownDNS traffic detected: queries for: 231.29.2.0.in-addr.arpa
Source: powershell.exe, 00000009.00000002.498582062.00000000009B8000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 5nXX3v5zWn.exe, 00000011.00000002.522566342.00000000037CC000.00000004.00000001.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: 5nXX3v5zWn.exe, 00000011.00000002.533674559.00000000078C0000.00000004.00000001.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt5=
Source: 5nXX3v5zWn.exe, 00000011.00000003.287584915.00000000062C0000.00000004.00000001.sdmpString found in binary or memory: http://en.w
Source: 5nXX3v5zWn.exe, 00000011.00000003.288794721.00000000062CB000.00000004.00000001.sdmp, 5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
Source: 5nXX3v5zWn.exe, 00000011.00000003.288891184.00000000062CB000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.comq
Source: 5nXX3v5zWn.exe, 00000011.00000002.522566342.00000000037CC000.00000004.00000001.sdmpString found in binary or memory: http://mail.spamora.net
Source: powershell.exe, 0000000E.00000002.528319560.0000000005944000.00000004.00000001.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: 5nXX3v5zWn.exe, 00000011.00000002.522566342.00000000037CC000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.sectigo.com0%
Source: powershell.exe, 0000000E.00000002.517938539.0000000004A23000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000007.00000002.518108271.0000000004D02000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.pngH
Source: powershell.exe, 00000007.00000002.519991834.0000000004DED000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.521443598.000000000485D000.00000004.00000001.sdmp, powershell.exe, 0000000E.00000002.524687995.0000000004FC3000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000007.00000002.509134453.0000000004BC1000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.518972104.0000000004631000.00000004.00000001.sdmp, powershell.exe, 0000000E.00000002.508174098.00000000048E1000.00000004.00000001.sdmp, 5nXX3v5zWn.exe, 00000011.00000002.506900664.0000000003321000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.519991834.0000000004DED000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.521443598.000000000485D000.00000004.00000001.sdmp, powershell.exe, 0000000E.00000002.524687995.0000000004FC3000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: 5nXX3v5zWn.exe, 00000011.00000003.295694072.00000000062C8000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000000E.00000002.517938539.0000000004A23000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000007.00000002.518108271.0000000004D02000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlH
Source: 5nXX3v5zWn.exe, 00000011.00000002.501039730.0000000001717000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.com
Source: 5nXX3v5zWn.exe, 00000011.00000003.314601492.00000000062BE000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
Source: 5nXX3v5zWn.exe, 00000011.00000003.315017748.00000000062BE000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
Source: 5nXX3v5zWn.exe, 00000011.00000003.317306866.00000000062EA000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: 5nXX3v5zWn.exe, 00000011.00000003.315017748.00000000062BE000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersv
Source: 5nXX3v5zWn.exe, 00000011.00000002.501039730.0000000001717000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comF
Source: 5nXX3v5zWn.exe, 00000011.00000002.501039730.0000000001717000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comas
Source: 5nXX3v5zWn.exe, 00000011.00000002.501039730.0000000001717000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.come.com
Source: 5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
Source: 5nXX3v5zWn.exe, 00000011.00000003.287998940.00000000062CB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comc
Source: 5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
Source: 5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
Source: powershell.exe, 0000000E.00000003.461384834.0000000009399000.00000004.00000001.sdmpString found in binary or memory: http://www.microsoft.co_
Source: vbc.exeString found in binary or memory: http://www.nirsoft.net/
Source: 5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
Source: 5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
Source: 5nXX3v5zWn.exe, 00000011.00000002.506900664.0000000003321000.00000004.00000001.sdmpString found in binary or memory: http://www.site.com/logs.php
Source: 5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
Source: 5nXX3v5zWn.exe, 00000011.00000003.290027281.00000000062CB000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comt.j
Source: 5nXX3v5zWn.exe, 00000011.00000003.289228966.00000000062CB000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comtn
Source: 5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
Source: powershell.exe, 0000000E.00000002.528319560.0000000005944000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.528319560.0000000005944000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.528319560.0000000005944000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000E.00000002.517938539.0000000004A23000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000007.00000002.518108271.0000000004D02000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/PesterH
Source: powershell.exe, 00000007.00000003.429431833.000000000556E000.00000004.00000001.sdmp, powershell.exe, 0000000E.00000002.525427017.00000000050E7000.00000004.00000001.sdmpString found in binary or memory: https://go.micro
Source: powershell.exe, 00000009.00000003.429673887.0000000004FDC000.00000004.00000001.sdmpString found in binary or memory: https://go.micro8
Source: vbc.exeString found in binary or memory: https://login.yahoo.com/config/login
Source: powershell.exe, 0000000E.00000002.528319560.0000000005944000.00000004.00000001.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: 5nXX3v5zWn.exe, 00000011.00000002.522566342.00000000037CC000.00000004.00000001.sdmpString found in binary or memory: https://sectigo.com/CPS0
Source: vbc.exeString found in binary or memory: https://www.google.com/accounts/servicelogin

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected HawkEye KeyloggerShow sources
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.45fa72.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.409c0d.1.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.334b1ec.5.raw.unpack, type: UNPACKEDPE
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_0040D674 OpenClipboard,GetLastError,DeleteFileW,
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30D802E0E248FEE17AAF4A62594CC75AJump to dropped file

System Summary:

barindex
Malicious sample detected (through community Yara rule)Show sources
Source: 17.2.5nXX3v5zWn.exe.45fa72.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 17.2.5nXX3v5zWn.exe.45fa72.2.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 17.2.5nXX3v5zWn.exe.408208.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 17.2.5nXX3v5zWn.exe.408208.3.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 17.2.5nXX3v5zWn.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 17.2.5nXX3v5zWn.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 17.2.5nXX3v5zWn.exe.409c0d.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 17.2.5nXX3v5zWn.exe.409c0d.1.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: 17.2.5nXX3v5zWn.exe.334b1ec.5.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00388280
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_0038D4B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_0038F6A9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_0038B688
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_0038BC08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00387340
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00385468
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00385457
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_0038B688
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00388AAC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00386ED0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00399678
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00399BA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_0039EC28
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00398EB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00394640
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00398958
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00399C98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00399C88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00394E00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_003A72D3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00B80040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00B8CB78
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DC85C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DCF708
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DCE9F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DCA9B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DCAF40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DC7280
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DC5399
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DC53A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DCF708
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DCA9B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DC8DF8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DC6E10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DF6348
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DFAE60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DF18A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DF0040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DF6348
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DFAE60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00DFAE60
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 17_2_078BB4E0
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 17_2_078BB198
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 17_2_078BEEC8
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 17_2_078BBDB0
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 17_2_078B0006
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00404419
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00404516
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00413538
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_004145A1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_0040E639
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_004337AF
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_004399B1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_0043DAE7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00405CF6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00403F85
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00411F99
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00442A90 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 004141D6 appears 88 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00413F8E appears 66 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00413E2D appears 34 times
Source: 5nXX3v5zWn.exe, 00000001.00000000.210021618.0000000000F60000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameSafeLsaPolicyHand.exe" vs 5nXX3v5zWn.exe
Source: 5nXX3v5zWn.exeBinary or memory string: OriginalFilename vs 5nXX3v5zWn.exe
Source: 5nXX3v5zWn.exe, 0000000F.00000002.274022671.0000000000430000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameSafeLsaPolicyHand.exe" vs 5nXX3v5zWn.exe
Source: 5nXX3v5zWn.exeBinary or memory string: OriginalFilename vs 5nXX3v5zWn.exe
Source: 5nXX3v5zWn.exe, 00000011.00000002.536121035.00000000089F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs 5nXX3v5zWn.exe
Source: 5nXX3v5zWn.exe, 00000011.00000002.536223795.0000000008A10000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dll.muij% vs 5nXX3v5zWn.exe
Source: 5nXX3v5zWn.exe, 00000011.00000002.506900664.0000000003321000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameCMemoryExecute.dll@ vs 5nXX3v5zWn.exe
Source: 5nXX3v5zWn.exe, 00000011.00000002.486267754.0000000000C50000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameSafeLsaPolicyHand.exe" vs 5nXX3v5zWn.exe
Source: 5nXX3v5zWn.exe, 00000011.00000002.482058861.0000000000482000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamePhulli.exe0 vs 5nXX3v5zWn.exe
Source: 5nXX3v5zWn.exe, 00000011.00000002.536186099.0000000008A00000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dllj% vs 5nXX3v5zWn.exe
Source: 5nXX3v5zWn.exe, 00000011.00000002.536347422.0000000008F20000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemswsock.dll.muij% vs 5nXX3v5zWn.exe
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeSection loaded: onecoreuapcommonproxystub.dll
Source: 5nXX3v5zWn.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: 17.2.5nXX3v5zWn.exe.7d90000.12.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.5nXX3v5zWn.exe.7d80000.11.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.5nXX3v5zWn.exe.45fa72.2.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 17.2.5nXX3v5zWn.exe.45fa72.2.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 17.2.5nXX3v5zWn.exe.408208.3.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 17.2.5nXX3v5zWn.exe.408208.3.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.5nXX3v5zWn.exe.408208.3.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 17.2.5nXX3v5zWn.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 17.2.5nXX3v5zWn.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.5nXX3v5zWn.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 17.2.5nXX3v5zWn.exe.409c0d.1.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
Source: 17.2.5nXX3v5zWn.exe.409c0d.1.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 17.2.5nXX3v5zWn.exe.335ed8c.6.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.5nXX3v5zWn.exe.334b1ec.5.raw.unpack, type: UNPACKEDPEMatched rule: HKTL_NET_GUID_Stealer date = 2020-12-29, author = Arnim Rupp, description = Detects c# red/black-team tools via typelibguid, reference = https://github.com/malwares/Stealer, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.5nXX3v5zWn.exe.334b1ec.5.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
Source: 5nXX3v5zWn.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: egGZqtIOrEmq.exe.1.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WindowsUpdate.exe.17.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engineClassification label: mal100.phis.troj.spyw.evad.winEXE@23/23@3/3
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00415AFD GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00415F87 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00411196 CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,QueryFullProcessImageNameW,CloseHandle,free,Process32NextW,CloseHandle,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00411EF8 FindResourceW,SizeofResource,LoadResource,LockResource,
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeFile created: C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exeJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2428:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3876:120:WilError_01
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeMutant created: \Sessions\1\BaseNamedObjects\gUNensdasyPYNch
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5620:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:592:120:WilError_01
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeFile created: C:\Users\user\AppData\Local\Temp\tmpA9C5.tmpJump to behavior
Source: 5nXX3v5zWn.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSystem information queried: HandleInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: vbc.exeBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: vbc.exeBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: vbc.exeBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: vbc.exeBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: vbc.exeBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: vbc.exeBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: 5nXX3v5zWn.exeVirustotal: Detection: 46%
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeFile read: C:\Users\user\Desktop\5nXX3v5zWn.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\5nXX3v5zWn.exe 'C:\Users\user\Desktop\5nXX3v5zWn.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\5nXX3v5zWn.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\egGZqtIOrEmq' /XML 'C:\Users\user\AppData\Local\Temp\tmpA9C5.tmp'
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Users\user\Desktop\5nXX3v5zWn.exe C:\Users\user\Desktop\5nXX3v5zWn.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Users\user\Desktop\5nXX3v5zWn.exe C:\Users\user\Desktop\5nXX3v5zWn.exe
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'
Source: unknownProcess created: C:\Users\user\AppData\Roaming\WindowsUpdate.exe 'C:\Users\user\AppData\Roaming\WindowsUpdate.exe'
Source: unknownProcess created: C:\Users\user\AppData\Roaming\WindowsUpdate.exe 'C:\Users\user\AppData\Roaming\WindowsUpdate.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\5nXX3v5zWn.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\egGZqtIOrEmq' /XML 'C:\Users\user\AppData\Local\Temp\tmpA9C5.tmp'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Users\user\Desktop\5nXX3v5zWn.exe C:\Users\user\Desktop\5nXX3v5zWn.exe
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Users\user\Desktop\5nXX3v5zWn.exe C:\Users\user\Desktop\5nXX3v5zWn.exe
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: 5nXX3v5zWn.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 5nXX3v5zWn.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: 5nXX3v5zWn.exeStatic file information: File size 1261056 > 1048576
Source: 5nXX3v5zWn.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x131800
Source: 5nXX3v5zWn.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: 5nXX3v5zWn.exe, 00000011.00000002.506900664.0000000003321000.00000004.00000001.sdmp
Source: Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: vbc.exe
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_004422C7 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_0038E2E0 push es; ret
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_003832E5 push eax; ret
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_00391C3D push ebx; iretd
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 9_2_0039CC70 push eax; retf 0037h
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00B86979 push eax; mov dword ptr [esp], edx
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00B86D30 push eax; mov dword ptr [esp], edx
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 14_2_00B89E20 push eax; mov dword ptr [esp], ecx
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 15_2_0033A133 push eax; ret
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 15_2_0033A228 push cs; ret
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 15_2_0042E5DC push ss; iretd
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 15_2_0033B29B push cs; ret
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 15_2_00428F7F push cs; ret
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 15_2_00339FD5 push cs; ret
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 17_2_00B5A133 push eax; ret
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 17_2_00C4E5DC push ss; iretd
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 17_2_00B5A228 push cs; ret
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 17_2_00B5B29B push cs; ret
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 17_2_00C48F7F push cs; ret
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 17_2_00B59FD5 push cs; ret
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 17_2_0572AC12 pushfd ; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00442871 push ecx; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00442A90 push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00442A90 push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00446E54 push eax; ret
Source: initial sampleStatic PE information: section name: .text entropy: 7.61581587782
Source: initial sampleStatic PE information: section name: .text entropy: 7.61581587782
Source: initial sampleStatic PE information: section name: .text entropy: 7.61581587782
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeFile created: C:\Users\user\AppData\Roaming\WindowsUpdate.exeJump to dropped file
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeFile created: C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exeJump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\egGZqtIOrEmq' /XML 'C:\Users\user\AppData\Local\Temp\tmpA9C5.tmp'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Windows Update
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Windows Update

Hooking and other Techniques for Hiding and Protection:

barindex
Changes the view of files in windows explorer (hidden files and folders)Show sources
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeKey value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00441975 memset,wcscpy,memset,wcscpy,wcscat,wcscpy,wcscat,wcscpy,wcscat,GetModuleHandleW,LoadLibraryExW,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry key monitored for changes: HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeKey value created or modified: HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB Blob
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)Show sources
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeWMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeCode function: 15_2_00431D21 sldt word ptr [eax]
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 180000
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3857
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3223
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4132
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2786
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4396
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2498
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeWindow / User API: threadDelayed 2800
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 3340Thread sleep time: -54672s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 5092Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5152Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5992Thread sleep count: 4132 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6036Thread sleep count: 2786 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3544Thread sleep count: 51 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5412Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5412Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4144Thread sleep count: 4396 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5980Thread sleep count: 2498 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5700Thread sleep count: 87 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 160Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 5236Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 2132Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4000Thread sleep time: -140000s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 64Thread sleep time: -36800s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 5404Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -99807s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -99687s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -99568s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -99453s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -99310s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -99156s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -99031s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -98906s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -98777s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -98671s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -98562s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -98327s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -98201s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -98047s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 5392Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -97903s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -97797s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exe TID: 4824Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeLast function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_004161B0 memset,GetSystemInfo,
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 54672
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 120000
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 140000
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 180000
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 100000
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 99807
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 99687
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 99568
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 99453
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 99310
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 99156
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 99031
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 98906
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 98777
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 98671
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 98562
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 98327
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 98201
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 98047
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 97903
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 97797
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeThread delayed: delay time: 922337203685477
Source: powershell.exe, 00000009.00000003.445755391.0000000004F42000.00000004.00000001.sdmp, powershell.exe, 0000000E.00000003.454009166.000000000531D000.00000004.00000001.sdmpBinary or memory string: Hyper-V
Source: 5nXX3v5zWn.exe, 00000011.00000002.534050302.0000000007988000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAWve MAC Layer LightWeight Filter-0000
Source: 5nXX3v5zWn.exeBinary or memory string: []qET]m8Z\3QqeMUKe4Ip]oUJD]gKD}{Z\4I[UoQpeoM[]pYpXDXI]DnKel4Z]}Q[TDnKel4Z]}Q[TiU[]qEjeyoJgks[dvIp\y{5Ux3Z]3Q[hWEzep8ZVoM[g3{ZgGEzf
Source: 5nXX3v5zWn.exe, 00000011.00000002.534173269.00000000079A7000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
Source: 5nXX3v5zWn.exe, 00000001.00000000.210021618.0000000000F60000.00000002.00020000.sdmp, 5nXX3v5zWn.exe, 0000000F.00000002.274022671.0000000000430000.00000002.00020000.sdmp, 5nXX3v5zWn.exe, 00000011.00000002.486267754.0000000000C50000.00000002.00020000.sdmpBinary or memory string: 385eGEzfv<pf385eG<IgogJD3Y6e8IJWo4Zg}YpXDTKhoU4[3Y5fDj[]n8ZVlIJYiU[]}ET]9o5XiU[]}Ez]xo5gkMKUx3Z]3Q[hWET]9o5XDXZek83[3Y5fDXJelI5fyE6fsUXVDL[]xoZ\385eGoHD}gpesUKgoQIDtYIDdsJD}gpesUKgoQ4[3Y5]DTKe4Ip]oUHD[UIDOMID}jIDnYphs85e|k5\xo6XDX5fkM3fq8Zd3U[]WETU}EDgvY[\pYJUiU[]qET]m8Z\3QqeMUKe4Ip]oUJD]gKD}{Z\4I[UoQpeoM[]pYpXDXI]DnKel4Z]}Q[TDnKel4Z]}Q[TiU[]qEjeyoJgks[dvIp\y{5Ux3Z]3Q[hWEzep8ZVoM[g3{ZgGEzfoQpf4<5foMoOwYJg}o6XDL[]qIpek4X]mM[gyQ[]VEz\xEDdP<HD7{XgDXZgvIpYiU[]}ET]4{
Source: powershell.exe, 00000007.00000002.518108271.0000000004D02000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.520573220.0000000004773000.00000004.00000001.sdmp, powershell.exe, 0000000E.00000002.517938539.0000000004A23000.00000004.00000001.sdmpBinary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformation
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_004422C7 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess token adjusted: Debug
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeMemory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

barindex
Adds a directory exclusion to Windows DefenderShow sources
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\5nXX3v5zWn.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\5nXX3v5zWn.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe'
Injects a PE file into a foreign processesShow sources
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeMemory written: C:\Users\user\Desktop\5nXX3v5zWn.exe base: 400000 value starts with: 4D5A
Sample uses process hollowing techniqueShow sources
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeSection unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeSection unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\5nXX3v5zWn.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\egGZqtIOrEmq' /XML 'C:\Users\user\AppData\Local\Temp\tmpA9C5.tmp'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Users\user\Desktop\5nXX3v5zWn.exe C:\Users\user\Desktop\5nXX3v5zWn.exe
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Users\user\Desktop\5nXX3v5zWn.exe C:\Users\user\Desktop\5nXX3v5zWn.exe
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'
Source: powershell.exe, 00000007.00000002.502841281.0000000003420000.00000002.00000001.sdmp, powershell.exe, 00000009.00000002.518251451.0000000003220000.00000002.00000001.sdmp, powershell.exe, 0000000E.00000002.503427661.00000000033B0000.00000002.00000001.sdmpBinary or memory string: Program Manager
Source: powershell.exe, 00000007.00000002.502841281.0000000003420000.00000002.00000001.sdmp, powershell.exe, 00000009.00000002.518251451.0000000003220000.00000002.00000001.sdmp, powershell.exe, 0000000E.00000002.503427661.00000000033B0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
Source: powershell.exe, 00000007.00000002.502841281.0000000003420000.00000002.00000001.sdmp, powershell.exe, 00000009.00000002.518251451.0000000003220000.00000002.00000001.sdmp, powershell.exe, 0000000E.00000002.503427661.00000000033B0000.00000002.00000001.sdmpBinary or memory string: Progman
Source: powershell.exe, 00000007.00000002.502841281.0000000003420000.00000002.00000001.sdmp, powershell.exe, 00000009.00000002.518251451.0000000003220000.00000002.00000001.sdmp, powershell.exe, 0000000E.00000002.503427661.00000000033B0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Users\user\Desktop\5nXX3v5zWn.exe VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Users\user\Desktop\5nXX3v5zWn.exe VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeQueries volume information: C:\Users\user\AppData\Roaming\WindowsUpdate.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeQueries volume information: C:\Users\user\AppData\Roaming\WindowsUpdate.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\WindowsUpdate.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_0041604B GetSystemTime,memcpy,GetCurrentProcessId,memcpy,GetTickCount,memcpy,QueryPerformanceCounter,memcpy,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 29_2_00407674 GetVersionExW,
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: 5nXX3v5zWn.exe, 00000011.00000002.533674559.00000000078C0000.00000004.00000001.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\5nXX3v5zWn.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information:

barindex
Yara detected HawkEye KeyloggerShow sources
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.45fa72.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.409c0d.1.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.334b1ec.5.raw.unpack, type: UNPACKEDPE
Yara detected MailPassViewShow sources
Source: Yara matchFile source: 30.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 30.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.45fa72.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.4329930.8.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.4329930.8.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.45fa72.2.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.409c0d.1.raw.unpack, type: UNPACKEDPE
Tries to harvest and steal browser information (history, passwords, etc)Show sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Tries to steal Instant Messenger accounts or passwordsShow sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Dynamic Salt
Tries to steal Mail credentials (via file access)Show sources
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
Yara detected WebBrowserPassView password recovery toolShow sources
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.4341b50.7.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.409c0d.1.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 29.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.4329930.8.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 29.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.4341b50.7.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.409c0d.1.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Detected HawkEye RatShow sources
Source: 5nXX3v5zWn.exe, 00000011.00000002.506900664.0000000003321000.00000004.00000001.sdmpString found in binary or memory: HawkEyeKeylogger
Source: 5nXX3v5zWn.exe, 00000011.00000002.506900664.0000000003321000.00000004.00000001.sdmpString found in binary or memory: l&HawkEye_Keylogger_Execution_Confirmed_
Source: 5nXX3v5zWn.exe, 00000011.00000002.506900664.0000000003321000.00000004.00000001.sdmpString found in binary or memory: l"HawkEye_Keylogger_Stealer_Records_
Yara detected HawkEye KeyloggerShow sources
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.45fa72.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.408208.3.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.409c0d.1.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 17.2.5nXX3v5zWn.exe.334b1ec.5.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management Instrumentation121DLL Side-Loading1DLL Side-Loading1Disable or Modify Tools11OS Credential Dumping1System Time Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumIngress Tool Transfer1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsNative API1Application Shimming1Application Shimming1Deobfuscate/Decode Files or Information1Credentials in Registry1File and Directory Discovery2Remote Desktop ProtocolData from Local System1Exfiltration Over BluetoothEncrypted Channel1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsShared Modules1Scheduled Task/Job1Process Injection212Obfuscated Files or Information4Credentials In Files1System Information Discovery19SMB/Windows Admin SharesEmail Collection1Automated ExfiltrationNon-Standard Port1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsScheduled Task/Job1Registry Run Keys / Startup Folder1Scheduled Task/Job1Software Packing3NTDSQuery Registry1Distributed Component Object ModelClipboard Data1Scheduled TransferRemote Access Software1SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptRegistry Run Keys / Startup Folder1DLL Side-Loading1LSA SecretsSecurity Software Discovery251SSHKeyloggingData Transfer Size LimitsNon-Application Layer Protocol2Manipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.commonMasquerading1Cached Domain CredentialsVirtualization/Sandbox Evasion151VNCGUI Input CaptureExfiltration Over C2 ChannelApplication Layer Protocol12Jamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsStartup ItemsModify Registry1DCSyncProcess Discovery4Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobVirtualization/Sandbox Evasion151Proc FilesystemApplication Window Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Process Injection212/etc/passwd and /etc/shadowRemote System Discovery1Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Hidden Files and Directories1Network SniffingProcess DiscoveryTaint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 448478 Sample: 5nXX3v5zWn Startdate: 14/07/2021 Architecture: WINDOWS Score: 100 61 Found malware configuration 2->61 63 Malicious sample detected (through community Yara rule) 2->63 65 Multi AV Scanner detection for dropped file 2->65 67 8 other signatures 2->67 7 5nXX3v5zWn.exe 7 2->7         started        11 WindowsUpdate.exe 2->11         started        13 WindowsUpdate.exe 2->13         started        process3 file4 43 C:\Users\user\AppData\...\egGZqtIOrEmq.exe, PE32 7->43 dropped 45 C:\Users\...\egGZqtIOrEmq.exe:Zone.Identifier, ASCII 7->45 dropped 47 C:\Users\user\AppData\Local\...\tmpA9C5.tmp, XML 7->47 dropped 49 C:\Users\user\AppData\...\5nXX3v5zWn.exe.log, ASCII 7->49 dropped 69 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 7->69 71 Uses schtasks.exe or at.exe to add and modify task schedules 7->71 73 Adds a directory exclusion to Windows Defender 7->73 75 Injects a PE file into a foreign processes 7->75 15 5nXX3v5zWn.exe 7->15         started        20 powershell.exe 23 7->20         started        22 powershell.exe 23 7->22         started        24 3 other processes 7->24 77 Multi AV Scanner detection for dropped file 11->77 79 Machine Learning detection for dropped file 11->79 signatures5 process6 dnsIp7 51 crt.sectigo.com 91.199.212.52, 49737, 80 SECTIGOGB United Kingdom 15->51 53 mail.spamora.net 185.26.106.194, 49736, 587 ATE-ASFR France 15->53 55 2 other IPs or domains 15->55 39 C:\Users\user\AppData\...\WindowsUpdate.exe, PE32 15->39 dropped 41 C:\...\WindowsUpdate.exe:Zone.Identifier, ASCII 15->41 dropped 57 Changes the view of files in windows explorer (hidden files and folders) 15->57 59 Sample uses process hollowing technique 15->59 26 vbc.exe 15->26         started        29 vbc.exe 15->29         started        31 conhost.exe 20->31         started        33 conhost.exe 22->33         started        35 conhost.exe 24->35         started        37 conhost.exe 24->37         started        file8 signatures9 process10 signatures11 81 Tries to steal Instant Messenger accounts or passwords 26->81 83 Tries to steal Mail credentials (via file access) 26->83 85 Tries to harvest and steal browser information (history, passwords, etc) 29->85

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
5nXX3v5zWn.exe46%VirustotalBrowse
5nXX3v5zWn.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe100%Joe Sandbox ML
C:\Users\user\AppData\Roaming\WindowsUpdate.exe100%Joe Sandbox ML
C:\Users\user\AppData\Roaming\WindowsUpdate.exe43%ReversingLabsByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe43%ReversingLabsByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

SourceDetectionScannerLabelLinkDownload
29.2.vbc.exe.400000.0.unpack100%AviraHEUR/AGEN.1125438Download File
17.2.5nXX3v5zWn.exe.400000.0.unpack100%AviraTR/AD.MExecute.lzracDownload File
17.2.5nXX3v5zWn.exe.400000.0.unpack100%AviraSPR/Tool.MailPassView.473Download File

Domains

SourceDetectionScannerLabelLink
mail.spamora.net1%VirustotalBrowse
crt.sectigo.com1%VirustotalBrowse
231.29.2.0.in-addr.arpa0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
https://contoso.com/License0%URL Reputationsafe
https://contoso.com/License0%URL Reputationsafe
https://contoso.com/License0%URL Reputationsafe
https://contoso.com/License0%URL Reputationsafe
http://www.tiro.com0%URL Reputationsafe
http://www.tiro.com0%URL Reputationsafe
http://www.tiro.com0%URL Reputationsafe
http://www.tiro.com0%URL Reputationsafe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt5=0%Avira URL Cloudsafe
http://www.goodfont.co.kr0%URL Reputationsafe
http://www.goodfont.co.kr0%URL Reputationsafe
http://www.goodfont.co.kr0%URL Reputationsafe
http://www.sajatypeworks.com0%URL Reputationsafe
http://www.sajatypeworks.com0%URL Reputationsafe
http://www.sajatypeworks.com0%URL Reputationsafe
http://www.typography.netD0%URL Reputationsafe
http://www.typography.netD0%URL Reputationsafe
http://www.typography.netD0%URL Reputationsafe
http://fontfabrik.comq0%Avira URL Cloudsafe
http://www.fontbureau.comas0%Avira URL Cloudsafe
http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
http://fontfabrik.com0%URL Reputationsafe
http://fontfabrik.com0%URL Reputationsafe
http://fontfabrik.com0%URL Reputationsafe
https://contoso.com/0%URL Reputationsafe
https://contoso.com/0%URL Reputationsafe
https://contoso.com/0%URL Reputationsafe
http://mail.spamora.net0%Avira URL Cloudsafe
http://www.sandoll.co.kr0%URL Reputationsafe
http://www.sandoll.co.kr0%URL Reputationsafe
http://www.sandoll.co.kr0%URL Reputationsafe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#0%URL Reputationsafe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#0%URL Reputationsafe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#0%URL Reputationsafe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0%URL Reputationsafe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0%URL Reputationsafe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0%URL Reputationsafe
http://www.fontbureau.comF0%URL Reputationsafe
http://www.fontbureau.comF0%URL Reputationsafe
http://www.fontbureau.comF0%URL Reputationsafe
https://sectigo.com/CPS00%URL Reputationsafe
https://sectigo.com/CPS00%URL Reputationsafe
https://sectigo.com/CPS00%URL Reputationsafe
http://www.fonts.comc0%URL Reputationsafe
http://www.fonts.comc0%URL Reputationsafe
http://www.fonts.comc0%URL Reputationsafe
http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
https://go.micro0%URL Reputationsafe
https://go.micro0%URL Reputationsafe
https://go.micro0%URL Reputationsafe
http://www.tiro.comt.j0%Avira URL Cloudsafe
https://contoso.com/Icon0%URL Reputationsafe
https://contoso.com/Icon0%URL Reputationsafe
https://contoso.com/Icon0%URL Reputationsafe
http://www.tiro.comtn0%Avira URL Cloudsafe
http://www.fontbureau.come.com0%URL Reputationsafe
http://www.fontbureau.come.com0%URL Reputationsafe
http://www.fontbureau.come.com0%URL Reputationsafe
http://en.w0%URL Reputationsafe
http://en.w0%URL Reputationsafe
http://en.w0%URL Reputationsafe
http://ocsp.sectigo.com0%0%Avira URL Cloudsafe
http://www.founder.com.cn/cn0%URL Reputationsafe
http://www.founder.com.cn/cn0%URL Reputationsafe
http://www.founder.com.cn/cn0%URL Reputationsafe
https://go.micro80%Avira URL Cloudsafe
http://pesterbdd.com/images/Pester.pngH0%Avira URL Cloudsafe
http://www.microsoft.co_0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
mail.spamora.net
185.26.106.194
truefalseunknown
crt.sectigo.com
91.199.212.52
truefalseunknown
231.29.2.0.in-addr.arpa
unknown
unknownfalseunknown

Contacted URLs

NameMaliciousAntivirus DetectionReputation
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crtfalse
  • URL Reputation: safe
  • URL Reputation: safe
  • URL Reputation: safe
unknown

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://www.founder.com.cn/cn/bThe5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpfalse
  • URL Reputation: safe
  • URL Reputation: safe
  • URL Reputation: safe
  • URL Reputation: safe
unknown
https://github.com/Pester/PesterHpowershell.exe, 00000007.00000002.518108271.0000000004D02000.00000004.00000001.sdmpfalse
    		high
    https://contoso.com/Licensepowershell.exe, 0000000E.00000002.528319560.0000000005944000.00000004.00000001.sdmpfalse
    • URL Reputation: safe
    • URL Reputation: safe
    • URL Reputation: safe
    • URL Reputation: safe
    		unknown
    http://www.tiro.com5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpfalse
    • URL Reputation: safe
    • URL Reputation: safe
    • URL Reputation: safe
    • URL Reputation: safe
    		unknown
    http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt5=5nXX3v5zWn.exe, 00000011.00000002.533674559.00000000078C0000.00000004.00000001.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://www.fontbureau.com/designers5nXX3v5zWn.exe, 00000011.00000003.314601492.00000000062BE000.00000004.00000001.sdmpfalse
      		high
      http://www.goodfont.co.kr5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpfalse
      • URL Reputation: safe
      • URL Reputation: safe
      • URL Reputation: safe
      		unknown
      http://www.sajatypeworks.com5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpfalse
      • URL Reputation: safe
      • URL Reputation: safe
      • URL Reputation: safe
      		unknown
      http://www.typography.netD5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpfalse
      • URL Reputation: safe
      • URL Reputation: safe
      • URL Reputation: safe
      		unknown
      http://fontfabrik.comq5nXX3v5zWn.exe, 00000011.00000003.288891184.00000000062CB000.00000004.00000001.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.fontbureau.comas5nXX3v5zWn.exe, 00000011.00000002.501039730.0000000001717000.00000004.00000040.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://www.founder.com.cn/cn/cThe5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpfalse
      • URL Reputation: safe
      • URL Reputation: safe
      • URL Reputation: safe
      		unknown
      http://fontfabrik.com5nXX3v5zWn.exe, 00000011.00000003.288794721.00000000062CB000.00000004.00000001.sdmp, 5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpfalse
      • URL Reputation: safe
      • URL Reputation: safe
      • URL Reputation: safe
      		unknown
      https://contoso.com/powershell.exe, 0000000E.00000002.528319560.0000000005944000.00000004.00000001.sdmpfalse
      • URL Reputation: safe
      • URL Reputation: safe
      • URL Reputation: safe
      		unknown
      https://nuget.org/nuget.exepowershell.exe, 0000000E.00000002.528319560.0000000005944000.00000004.00000001.sdmpfalse
        		high
        http://mail.spamora.net5nXX3v5zWn.exe, 00000011.00000002.522566342.00000000037CC000.00000004.00000001.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://www.fontbureau.com/designersv5nXX3v5zWn.exe, 00000011.00000003.315017748.00000000062BE000.00000004.00000001.sdmpfalse
          		high
          https://login.yahoo.com/config/loginvbc.exefalse
            		high
            http://www.fonts.com5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpfalse
              		high
              http://www.sandoll.co.kr5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.site.com/logs.php5nXX3v5zWn.exe, 00000011.00000002.506900664.0000000003321000.00000004.00000001.sdmpfalse
                		high
                http://www.nirsoft.net/vbc.exefalse
                  		high
                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000007.00000002.509134453.0000000004BC1000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.518972104.0000000004631000.00000004.00000001.sdmp, powershell.exe, 0000000E.00000002.508174098.00000000048E1000.00000004.00000001.sdmp, 5nXX3v5zWn.exe, 00000011.00000002.506900664.0000000003321000.00000004.00000001.sdmpfalse
                    		high
                    http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#5nXX3v5zWn.exe, 00000011.00000002.522566342.00000000037CC000.00000004.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    		unknown
                    http://nuget.org/NuGet.exepowershell.exe, 0000000E.00000002.528319560.0000000005944000.00000004.00000001.sdmpfalse
                      		high
                      http://www.apache.org/licenses/LICENSE-2.05nXX3v5zWn.exe, 00000011.00000003.295694072.00000000062C8000.00000004.00000001.sdmpfalse
                        		high
                        http://www.fontbureau.com5nXX3v5zWn.exe, 00000011.00000002.501039730.0000000001717000.00000004.00000040.sdmpfalse
                          		high
                          http://www.fontbureau.comF5nXX3v5zWn.exe, 00000011.00000002.501039730.0000000001717000.00000004.00000040.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          https://sectigo.com/CPS05nXX3v5zWn.exe, 00000011.00000002.522566342.00000000037CC000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.fonts.comc5nXX3v5zWn.exe, 00000011.00000003.287998940.00000000062CB000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000000E.00000002.517938539.0000000004A23000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000007.00000002.519991834.0000000004DED000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.521443598.000000000485D000.00000004.00000001.sdmp, powershell.exe, 0000000E.00000002.524687995.0000000004FC3000.00000004.00000001.sdmpfalse
                            		high
                            http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000000E.00000002.517938539.0000000004A23000.00000004.00000001.sdmpfalse
                              		high
                              https://go.micropowershell.exe, 00000007.00000003.429431833.000000000556E000.00000004.00000001.sdmp, powershell.exe, 0000000E.00000002.525427017.00000000050E7000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.tiro.comt.j5nXX3v5zWn.exe, 00000011.00000003.290027281.00000000062CB000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.apache.org/licenses/LICENSE-2.0.htmlHpowershell.exe, 00000007.00000002.518108271.0000000004D02000.00000004.00000001.sdmpfalse
                                		high
                                https://contoso.com/Iconpowershell.exe, 0000000E.00000002.528319560.0000000005944000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.tiro.comtn5nXX3v5zWn.exe, 00000011.00000003.289228966.00000000062CB000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.fontbureau.come.com5nXX3v5zWn.exe, 00000011.00000002.501039730.0000000001717000.00000004.00000040.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                https://github.com/Pester/Pesterpowershell.exe, 0000000E.00000002.517938539.0000000004A23000.00000004.00000001.sdmpfalse
                                  		high
                                  http://en.w5nXX3v5zWn.exe, 00000011.00000003.287584915.00000000062C0000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://ocsp.sectigo.com0%5nXX3v5zWn.exe, 00000011.00000002.522566342.00000000037CC000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		low
                                  http://www.founder.com.cn/cn5nXX3v5zWn.exe, 00000011.00000002.532711160.00000000074C2000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.com/designers/cabarga.html5nXX3v5zWn.exe, 00000011.00000003.317306866.00000000062EA000.00000004.00000001.sdmpfalse
                                    		high
                                    https://go.micro8powershell.exe, 00000009.00000003.429673887.0000000004FDC000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://pesterbdd.com/images/Pester.pngHpowershell.exe, 00000007.00000002.518108271.0000000004D02000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000007.00000002.519991834.0000000004DED000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.521443598.000000000485D000.00000004.00000001.sdmp, powershell.exe, 0000000E.00000002.524687995.0000000004FC3000.00000004.00000001.sdmpfalse
                                      		high
                                      http://www.fontbureau.com/designers/5nXX3v5zWn.exe, 00000011.00000003.315017748.00000000062BE000.00000004.00000001.sdmpfalse
                                        		high
                                        http://www.microsoft.co_powershell.exe, 0000000E.00000003.461384834.0000000009399000.00000004.00000001.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		low

                                        Contacted IPs

                                        • No. of IPs < 25%
                                        • 25% < No. of IPs < 50%
                                        • 50% < No. of IPs < 75%
                                        • 75% < No. of IPs

                                        Public

                                        IPDomainCountryFlagASNASN NameMalicious
                                        91.199.212.52
                                        		crt.sectigo.comUnited Kingdom
                                        		48447SECTIGOGBfalse
                                        185.26.106.194
                                        		mail.spamora.netFrance
                                        		24935ATE-ASFRfalse

                                        Private

                                        IP
                                        192.168.2.1

                                        General Information

                                        Joe Sandbox Version:33.0.0 White Diamond
                                        Analysis ID:448478
                                        Start date:14.07.2021
                                        Start time:09:33:33
                                        Joe Sandbox Product:CloudBasic
                                        Overall analysis duration:0h 17m 35s
                                        Hypervisor based Inspection enabled:false
                                        Report type:light
                                        Sample file name:5nXX3v5zWn (renamed file extension from none to exe)
                                        Cookbook file name:default.jbs
                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                        Number of analysed new started processes analysed:39
                                        Number of new started drivers analysed:0
                                        Number of existing processes analysed:0
                                        Number of existing drivers analysed:0
                                        Number of injected processes analysed:0
                                        Technologies:
                                        • HCA enabled
                                        • EGA enabled
                                        • HDC enabled
                                        • AMSI enabled
                                        Analysis Mode:default
                                        Analysis stop reason:Timeout
                                        Detection:MAL
                                        Classification:mal100.phis.troj.spyw.evad.winEXE@23/23@3/3
                                        EGA Information:Failed
                                        HDC Information:
                                        • Successful, ratio: 0.1% (good quality ratio 0.1%)
                                        • Quality average: 78.5%
                                        • Quality standard deviation: 14.5%
                                        HCA Information:
                                        • Successful, ratio: 98%
                                        • Number of executed functions: 0
                                        • Number of non-executed functions: 0
                                        Cookbook Comments:
                                        • Adjust boot time
                                        • Enable AMSI
                                        Warnings:
                                        Show All
                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe
                                        • Excluded IPs from analysis (whitelisted): 104.42.151.234, 52.255.188.83, 23.54.113.53, 13.88.21.125, 52.147.198.201, 95.100.54.203, 20.82.210.154, 40.112.88.60, 20.82.209.183, 23.10.249.25, 23.10.249.26, 20.50.102.62
                                        • Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, arc.msn.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net
                                        • Not all processes where analyzed, report is missing behavior information
                                        • Report creation exceeded maximum time and may have missing behavior and disassembly information.
                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                        • Report size getting too big, too many NtCreateFile calls found.
                                        • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                        • Report size getting too big, too many NtQueryValueKey calls found.

                                        Simulations

                                        Behavior and APIs

                                        TimeTypeDescription
                                        09:34:48API Interceptor24x Sleep call for process: 5nXX3v5zWn.exe modified
                                        09:35:31AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Update C:\Users\user\AppData\Roaming\WindowsUpdate.exe
                                        09:35:40AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows Update C:\Users\user\AppData\Roaming\WindowsUpdate.exe
                                        09:35:52API Interceptor154x Sleep call for process: powershell.exe modified

                                        Joe Sandbox View / Context

                                        IPs

                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                        91.199.212.52H8KFZGwAkB.dllGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        Cmh_Fax-Message-3865.htmlGet hashmaliciousBrowse
                                        • zerossl.crt.sectigo.com/ZeroSSLRSADomainSecureSiteCA.crt
                                        guesZQt4Yz.exeGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        2naHs0NOfi.dllGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        3.dllGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        3.dllGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        saturo[1].htmGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        cat.exeGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        OW73NJTujh.dllGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        Ak6qIKCI0f.dllGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        DOCUMENT.DLLGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        PNmTyT6wHi.dllGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        DOCUMENT.DLLGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        Documents.dllGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        s.dllGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        s.dllGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
                                        publiclicense.vbsGet hashmaliciousBrowse
                                        • zerossl.crt.sectigo.com/ZeroSSLRSADomainSecureSiteCA.crt
                                        3PL0-MDEO3H-GOF4.htmlGet hashmaliciousBrowse
                                        • zerossl.crt.sectigo.com/ZeroSSLRSADomainSecureSiteCA.crt
                                        pieChart2.exeGet hashmaliciousBrowse
                                        • crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt

                                        Domains

                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                        mail.spamora.netDoc_386384934.xlsxGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Doc_38464835648343.xlsxGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        pfI78aQqmv.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Inquiry.xlsxGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Doc_87654334567.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        PO-4600017931.xlsxGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        HTOj2DnVlw.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        i7Qs22QuKz.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Doc.xlsxGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Doc_3956385638364836437638364738365483647383648373638463836483648363846383.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Doc_987945678.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Ref-2021-05-14.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Doc_38464856384683648364.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Document_printout_copy_34853936483648364393743836384.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        DHL_SHIPMENT_ADDRESS_4495749574946596484658458458,pdf.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        RFQ_38463846393646388368364834.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Doc_3847468364836483638463,pdf.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        9385839583309483484303843094034.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        SIN_TONG_HWA_TRADING,pdf.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        9qyjV3QacT.exeGet hashmaliciousBrowse
                                        • 185.26.106.194

                                        ASN

                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                        SECTIGOGBH8KFZGwAkB.dllGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        Cmh_Fax-Message-3865.htmlGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        guesZQt4Yz.exeGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        2naHs0NOfi.dllGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        3.dllGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        3.dllGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        saturo[1].htmGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        cat.exeGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        OW73NJTujh.dllGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        Ak6qIKCI0f.dllGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        DOCUMENT.DLLGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        PNmTyT6wHi.dllGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        DOCUMENT.DLLGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        Documents.dllGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        s.dllGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        s.dllGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        publiclicense.vbsGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        3PL0-MDEO3H-GOF4.htmlGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        pieChart2.exeGet hashmaliciousBrowse
                                        • 91.199.212.52
                                        ATE-ASFRDoc_386384934.xlsxGet hashmaliciousBrowse
                                        • 185.26.106.165
                                        Doc_38464835648343.xlsxGet hashmaliciousBrowse
                                        • 185.26.106.165
                                        pfI78aQqmv.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Inquiry.xlsxGet hashmaliciousBrowse
                                        • 185.26.106.165
                                        Doc_87654334567.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        PO-4600017931.xlsxGet hashmaliciousBrowse
                                        • 185.26.106.165
                                        HTOj2DnVlw.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        i7Qs22QuKz.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Doc.xlsxGet hashmaliciousBrowse
                                        • 185.26.106.165
                                        Doc_3956385638364836437638364738365483647383648373638463836483648363846383.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Doc_987945678.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Ref-2021-05-14.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Doc_38464856384683648364.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Document_printout_copy_34853936483648364393743836384.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        DHL_SHIPMENT_ADDRESS_4495749574946596484658458458,pdf.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        DOCUMENT_395849584954.exeGet hashmaliciousBrowse
                                        • 185.26.106.165
                                        RFQ_38463846393646388368364834.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Doc_3847468364836483638463,pdf.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        9385839583309483484303843094034.exeGet hashmaliciousBrowse
                                        • 185.26.106.194
                                        Order_364537463746347485945454.xlsxGet hashmaliciousBrowse
                                        • 185.26.106.165

                                        JA3 Fingerprints

                                        No context

                                        Dropped Files

                                        No context

                                        Created / dropped Files

                                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30D802E0E248FEE17AAF4A62594CC75A
                                        Process:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):1559
                                        Entropy (8bit):7.399832861783252
                                        Encrypted:false
                                        SSDEEP:48:B4wgi+96jf8TXJgnXpxi4sVtcTtrdoh+S:KiIq0eZnep
                                        MD5:ADAB5C4DF031FB9299F71ADA7E18F613
                                        SHA1:33E4E80807204C2B6182A3A14B591ACD25B5F0DB
                                        SHA-256:7FA4FF68EC04A99D7528D5085F94907F4D1DD1C5381BACDC832ED5C960214676
                                        SHA-512:983B974E459A46EB7A3C8850EC90CC16D3B6D4A1505A5BCDD710C236BAF5AADC58424B192E34A147732E9D436C9FC04D896D8A7700FF349252A57514F588C6A1
                                        Malicious:false
                                        Preview: 0...0..........}[Q&.v...t...S..0...*.H........0..1.0...U....US1.0...U....New Jersey1.0...U....Jersey City1.0...U....The USERTRUST Network1.0,..U...%USERTrust RSA Certification Authority0...181102000000Z..301231235959Z0..1.0...U....GB1.0...U....Greater Manchester1.0...U....Salford1.0...U....Sectigo Limited1705..U....Sectigo RSA Domain Validation Secure Server CA0.."0...*.H.............0.........s3..< ....E..>..?.A.20.l.......-?.M......b..Hy...N..2%.....P?.L.@*.9.....2A.&.#z. ... .<.Do.u..@.2.....#>...o]Q.j.i.O.ri..Lm.....~......7x...4.V.X....d[.7..(h.V...\......$..0......z...B......J.....@..o.BJd..0.....'Z..X......c.oV...`4.t........_.........n0..j0...U.#..0...Sy.Z.+J.T.......f.0...U........^.T...w.......a.0...U...........0...U.......0.......0...U.%..0...+.........+.......0...U. ..0.0...U. .0...g.....0P..U...I0G0E.C.A.?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v..+........j0h0?..+.....0..3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%..+.....0.
                                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30D802E0E248FEE17AAF4A62594CC75A
                                        Process:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        File Type:data
                                        Category:modified
                                        Size (bytes):282
                                        Entropy (8bit):3.1368173556949515
                                        Encrypted:false
                                        SSDEEP:3:kkFklhLpwkNvfllXlE/lPbXx8bqlF8tlije9DZl2i9XYolzlIlMltuN7ANJbZ15z:kK6RNyjXxp9jKFlIaYM2+/LOjA/
                                        MD5:E46482A591E6E2926D676D36A231C676
                                        SHA1:2B62C2F4D903CAFA707B0C2927D378E1FD42BFAF
                                        SHA-256:C4153C1C2F053DFF266A528F81CEBCC2464F1B922F4060D62C141715EA593989
                                        SHA-512:A8A9E1B516C7C619CD8DA30DFEFC935ED9324A99CF694D7F0A9A4582AD59E2F75720A80C8341D00B1C6F220F6AD326880D0C8028A04FC0A76354CFEDF3E46BD3
                                        Malicious:false
                                        Preview: p...... ........T....x..(....................................................... ........@u.>r..@8..................h.t.t.p.:././.c.r.t...s.e.c.t.i.g.o...c.o.m./.S.e.c.t.i.g.o.R.S.A.D.o.m.a.i.n.V.a.l.i.d.a.t.i.o.n.S.e.c.u.r.e.S.e.r.v.e.r.C.A...c.r.t...".5.b.d.b.9.3.8.0.-.6.1.7."...
                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5nXX3v5zWn.exe.log
                                        Process:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:modified
                                        Size (bytes):1308
                                        Entropy (8bit):5.345811588615766
                                        Encrypted:false
                                        SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84FsXE8:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzu
                                        MD5:2E016B886BDB8389D2DD0867BE55F87B
                                        SHA1:25D28EF2ACBB41764571E06E11BF4C05DD0E2F8B
                                        SHA-256:1D037CF00A8849E6866603297F85D3DABE09535E72EDD2636FB7D0F6C7DA3427
                                        SHA-512:C100729153954328AA2A77EECB2A3CBD03CB7E8E23D736000F890B17AAA50BA87745E30FB9E2B0D61E16DCA45694C79B4CE09B9F4475220BEB38CAEA546CFC2A
                                        Malicious:true
                                        Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:data
                                        Category:modified
                                        Size (bytes):14734
                                        Entropy (8bit):4.993014478972177
                                        Encrypted:false
                                        SSDEEP:384:cBVoGIpN6KQkj2Wkjh4iUxx5djHWrxbXX35PYoGib4J:cBV3IpNBQkj2Lh4iUxx5djHWrxbH3RYH
                                        MD5:456B58368F1597035565FF5661D0A2CE
                                        SHA1:DAC873BF6060F400AB309C040948848CD3019B11
                                        SHA-256:C1273918592A45B7B6CEABC376395C6701D5C83642143C824BE3E316F9131AA9
                                        SHA-512:B55743EFD8588B68A89983553BE54FEDBB45F1877513CBA477CBCA36EA2E4D6F6140D61FC342EB326CB0B485E26BAC515B234DCD34909129C4339AAEF18B4889
                                        Malicious:false
                                        Preview: PSMODULECACHE......<.e...Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........<.e...T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....
                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_102g4eb0.ed4.ps1
                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:very short file (no magic)
                                        Category:dropped
                                        Size (bytes):1
                                        Entropy (8bit):0.0
                                        Encrypted:false
                                        SSDEEP:3:U:U
                                        MD5:C4CA4238A0B923820DCC509A6F75849B
                                        SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                        SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                        SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                        Malicious:false
                                        Preview: 1
                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_53yqb03u.w2f.ps1
                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:very short file (no magic)
                                        Category:dropped
                                        Size (bytes):1
                                        Entropy (8bit):0.0
                                        Encrypted:false
                                        SSDEEP:3:U:U
                                        MD5:C4CA4238A0B923820DCC509A6F75849B
                                        SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                        SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                        SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                        Malicious:false
                                        Preview: 1
                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b3j5vb2e.zhc.psm1
                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:very short file (no magic)
                                        Category:dropped
                                        Size (bytes):1
                                        Entropy (8bit):0.0
                                        Encrypted:false
                                        SSDEEP:3:U:U
                                        MD5:C4CA4238A0B923820DCC509A6F75849B
                                        SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                        SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                        SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                        Malicious:false
                                        Preview: 1
                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mfl5jaou.44l.psm1
                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:very short file (no magic)
                                        Category:dropped
                                        Size (bytes):1
                                        Entropy (8bit):0.0
                                        Encrypted:false
                                        SSDEEP:3:U:U
                                        MD5:C4CA4238A0B923820DCC509A6F75849B
                                        SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                        SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                        SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                        Malicious:false
                                        Preview: 1
                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uyn15uet.dem.psm1
                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:very short file (no magic)
                                        Category:dropped
                                        Size (bytes):1
                                        Entropy (8bit):0.0
                                        Encrypted:false
                                        SSDEEP:3:U:U
                                        MD5:C4CA4238A0B923820DCC509A6F75849B
                                        SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                        SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                        SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                        Malicious:false
                                        Preview: 1
                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vth45tfl.sdf.ps1
                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:very short file (no magic)
                                        Category:dropped
                                        Size (bytes):1
                                        Entropy (8bit):0.0
                                        Encrypted:false
                                        SSDEEP:3:U:U
                                        MD5:C4CA4238A0B923820DCC509A6F75849B
                                        SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                        SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                        SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                        Malicious:false
                                        Preview: 1
                                        C:\Users\user\AppData\Local\Temp\holderwb.txt
                                        Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                        File Type:Little-endian UTF-16 Unicode text, with no line terminators
                                        Category:dropped
                                        Size (bytes):2
                                        Entropy (8bit):1.0
                                        Encrypted:false
                                        SSDEEP:3:Qn:Qn
                                        MD5:F3B25701FE362EC84616A93A45CE9998
                                        SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                        SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                        SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                        Malicious:false
                                        Preview: ..
                                        C:\Users\user\AppData\Local\Temp\tmpA9C5.tmp
                                        Process:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):1645
                                        Entropy (8bit):5.193776238895854
                                        Encrypted:false
                                        SSDEEP:24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBvutn:cbh47TlNQ//rydbz9I3YODOLNdq39I
                                        MD5:54A7468F56A3A2CD1077D5BC5F5E1CF5
                                        SHA1:546DB1F0DA9CBFC04C741F850261FB3862C7E653
                                        SHA-256:03E45CEFC430010C346C2A0A872644AA1CC0EA468BC0897ED3D9D764C7DFF8BF
                                        SHA-512:8C305AA91EA03F18D21BAC550E34A2AF142A8E85667173B6B5C741BBFC09BCF553AB2686313E2AD78A8A971E0D4907E2B2A48D138E144C7D2D8D2911F8D5228A
                                        Malicious:true
                                        Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true
                                        C:\Users\user\AppData\Roaming\WindowsUpdate.exe
                                        Process:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                        Category:dropped
                                        Size (bytes):1261056
                                        Entropy (8bit):7.612252755280688
                                        Encrypted:false
                                        SSDEEP:24576:J57dzqnUYOCGSfCuuBIRzCa6RMdLAEDv+tgd3gD:hgN97ugl6sUEHd3g
                                        MD5:E35A0BDB66B37B80C51A1559058E326B
                                        SHA1:42D31FFA8A8A38D5073220550CAE44D3E91BF9D6
                                        SHA-256:4D16AC850F443E678E5CDC8C104F9369A97E8347C3A64F3FCE173329072FEE53
                                        SHA-512:ECF25580F0877CD47826BD23C60C1A871FC8A68C12E300776681B97A55406DD6523981755C477F4E76D09FFC67471E96E784CAE65D1A32F1F023504D26F8E186
                                        Malicious:true
                                        Antivirus:
                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                        • Antivirus: ReversingLabs, Detection: 43%
                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+..`.....................$.......5... ........@.. ....................................@..................................5..W....@..."........................................................................... ............... ..H............text........ ...................... ..`.rsrc...."...@..."..................@..@.reloc...............<..............@..B.................5......H............2......t........`............................................(....*&..(.....*...s.........s.........s.........s.........s.........*.0...........~....o.....+..*.0...........~....o.....+..*.0...........~....o.....+..*.0...........~....o.....+..*.0...........~....o.....+..*.0.................,.........o....+....9....~.........,2~.........(....o......,.r...p......(....s....z..+..s..........~.........(.....o......(...+..tu....%-.&.+.%(........o................&r;..p..
                                        C:\Users\user\AppData\Roaming\WindowsUpdate.exe:Zone.Identifier
                                        Process:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):26
                                        Entropy (8bit):3.95006375643621
                                        Encrypted:false
                                        SSDEEP:3:ggPYV:rPYV
                                        MD5:187F488E27DB4AF347237FE461A079AD
                                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                        Malicious:true
                                        Preview: [ZoneTransfer]....ZoneId=0
                                        C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe
                                        Process:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                        Category:dropped
                                        Size (bytes):1261056
                                        Entropy (8bit):7.612252755280688
                                        Encrypted:false
                                        SSDEEP:24576:J57dzqnUYOCGSfCuuBIRzCa6RMdLAEDv+tgd3gD:hgN97ugl6sUEHd3g
                                        MD5:E35A0BDB66B37B80C51A1559058E326B
                                        SHA1:42D31FFA8A8A38D5073220550CAE44D3E91BF9D6
                                        SHA-256:4D16AC850F443E678E5CDC8C104F9369A97E8347C3A64F3FCE173329072FEE53
                                        SHA-512:ECF25580F0877CD47826BD23C60C1A871FC8A68C12E300776681B97A55406DD6523981755C477F4E76D09FFC67471E96E784CAE65D1A32F1F023504D26F8E186
                                        Malicious:true
                                        Antivirus:
                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                        • Antivirus: ReversingLabs, Detection: 43%
                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+..`.....................$.......5... ........@.. ....................................@..................................5..W....@..."........................................................................... ............... ..H............text........ ...................... ..`.rsrc...."...@..."..................@..@.reloc...............<..............@..B.................5......H............2......t........`............................................(....*&..(.....*...s.........s.........s.........s.........s.........*.0...........~....o.....+..*.0...........~....o.....+..*.0...........~....o.....+..*.0...........~....o.....+..*.0...........~....o.....+..*.0.................,.........o....+....9....~.........,2~.........(....o......,.r...p......(....s....z..+..s..........~.........(.....o......(...+..tu....%-.&.+.%(........o................&r;..p..
                                        C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe:Zone.Identifier
                                        Process:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):26
                                        Entropy (8bit):3.95006375643621
                                        Encrypted:false
                                        SSDEEP:3:ggPYV:rPYV
                                        MD5:187F488E27DB4AF347237FE461A079AD
                                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                        Malicious:true
                                        Preview: [ZoneTransfer]....ZoneId=0
                                        C:\Users\user\AppData\Roaming\pid.txt
                                        Process:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:dropped
                                        Size (bytes):4
                                        Entropy (8bit):2.0
                                        Encrypted:false
                                        SSDEEP:3:V3:V
                                        MD5:34FFEB359A192EB8174B6854643CC046
                                        SHA1:B6356EEB8338BF9C15899584BBB23135B40452E9
                                        SHA-256:AAF68675C4BEA5600C273F6D4371E8D1B9F383A6DD96DB30D628CF77DD91C09C
                                        SHA-512:7125DC16314E6314E32BE5A58539CA75B0E7B6C93B5F1F443FD79E991EDBDBA5BD11F8333EF60EB6CD193149339D547DEB837284165D0805FA98BDE473DC5323
                                        Malicious:false
                                        Preview: 3708
                                        C:\Users\user\AppData\Roaming\pidloc.txt
                                        Process:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        File Type:ASCII text, with no line terminators
                                        Category:dropped
                                        Size (bytes):37
                                        Entropy (8bit):4.378240189894803
                                        Encrypted:false
                                        SSDEEP:3:oNWXp5vQzJan:oNWXpFQzJa
                                        MD5:9B2E0EF287AECA34C538735F6911FF16
                                        SHA1:799321AE3A0E0AB5DF00271838F3474413A1E65E
                                        SHA-256:9624C88E7D3593FBEE0AD1F0260CFA8790B1B9120F0C620965A5C70545B15F48
                                        SHA-512:4474C7CE433130E3D2936E541F85DEA3656EE2ADCCD26E4267C9BA4C9A0C0A34FCC186F2AFD67D85941C386678271B958636F2A401961F58DF6437746DAA6638
                                        Malicious:false
                                        Preview: C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        C:\Users\user\Documents\20210714\PowerShell_transcript.138727.JIVpCcrj.20210714093452.txt
                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):830
                                        Entropy (8bit):5.332111071096532
                                        Encrypted:false
                                        SSDEEP:24:BxSAWyxvBnEx2DOXUWeSunWoHjeTKKjX4CIym1ZJX+Quf:BZWuvhEoO+SZoqDYB1ZUQi
                                        MD5:94588FD4A32EB364C910B1E6AD32D23B
                                        SHA1:1DA2A4FCC3BC452A1E7398B5CB45A624E942E216
                                        SHA-256:E1848E3832F83A9069FE97556CE8EDA2218FF98CEC263E9F20E171015E42AB4D
                                        SHA-512:69007B309A4DFEDB1E4F61969EEE428CCD276C44BC563B3555A9164531FFC6EBAA8DA15254AF0A9D44C27C7FD1594F4F6FED6BD4CB3D05AA97652ED11F027C82
                                        Malicious:false
                                        Preview: .**********************..Windows PowerShell transcript start..Start time: 20210714093523..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 138727 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\Desktop\5nXX3v5zWn.exe..Process ID: 4116..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20210714093523..**********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\Desktop\5nXX3v5zWn.exe..
                                        C:\Users\user\Documents\20210714\PowerShell_transcript.138727.fYco6+D0.20210714093453.txt
                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):850
                                        Entropy (8bit):5.377039057069052
                                        Encrypted:false
                                        SSDEEP:24:BxSAWIyxvBnEx2DOXUWeSu7+W9HjeTKKjX4CIym1ZJX++u7S:BZWVvhEoO+Sap9qDYB1ZU+aS
                                        MD5:4EF8EF97D8E4E08A184CD43F7097033C
                                        SHA1:F92F94AFDF384855D165E1BFED84ED7F600E812B
                                        SHA-256:E613E0385939AD5341FC47B3263DE8607323989F917C1200B141E8E09746700D
                                        SHA-512:718FFAA99783B53F1BA0381A270C92BDB2E3E065F583B4A2868E0488B6B7A0DD234CE14694DD07D751708EA85745C0A689F16B1A5CE0E4C348D917F2A5F4C16E
                                        Malicious:false
                                        Preview: .**********************..Windows PowerShell transcript start..Start time: 20210714093524..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 138727 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe..Process ID: 5796..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20210714093525..**********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe..
                                        C:\Users\user\Documents\20210714\PowerShell_transcript.138727.oUfNsHgU.20210714093455.txt
                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        File Type:UTF-8 Unicode (with BOM) text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):850
                                        Entropy (8bit):5.375135860207132
                                        Encrypted:false
                                        SSDEEP:24:BxSAWDyxvBnEx2DOXUWeSu7+W4HjeTKKjX4CIym1ZJX+PFu7S:BZWCvhEoO+Sap4qDYB1ZUNaS
                                        MD5:2C05EFF153AF7A0EAC8540EA6E272E53
                                        SHA1:C2B06ADB191827F59E9B52DF54FE22DFA8144469
                                        SHA-256:FD4FEEAE6F18B3D8F1D1430AE723887D80DC4971E8D2E74BEEEC0D25EC637F35
                                        SHA-512:900A1FA87F9ED873B99BC9EF95EEECCC4D70EE844467C0E02D145A0CAF4DF77DC1E7B6EC18EFA0C496F1DE6C577F43E7C7B953970E081CF4538C1D76AA3F4144
                                        Malicious:false
                                        Preview: .**********************..Windows PowerShell transcript start..Start time: 20210714093534..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 138727 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe..Process ID: 2396..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..**********************..**********************..Command start time: 20210714093535..**********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe..

                                        Static File Info

                                        General

                                        File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                        Entropy (8bit):7.612252755280688
                                        TrID:
                                        • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                        • Win32 Executable (generic) a (10002005/4) 49.78%
                                        • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                        • Generic Win/DOS Executable (2004/3) 0.01%
                                        • DOS Executable Generic (2002/1) 0.01%
                                        File name:5nXX3v5zWn.exe
                                        File size:1261056
                                        MD5:e35a0bdb66b37b80c51a1559058e326b
                                        SHA1:42d31ffa8a8a38d5073220550cae44d3e91bf9d6
                                        SHA256:4d16ac850f443e678e5cdc8c104f9369a97e8347c3a64f3fce173329072fee53
                                        SHA512:ecf25580f0877cd47826bd23c60c1a871fc8a68c12e300776681b97a55406dd6523981755c477f4e76d09ffc67471e96e784cae65d1a32f1f023504d26f8e186
                                        SSDEEP:24576:J57dzqnUYOCGSfCuuBIRzCa6RMdLAEDv+tgd3gD:hgN97ugl6sUEHd3g
                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+..`.....................$.......5... ........@.. ....................................@................................

                                        File Icon

                                        Icon Hash:97194b4a5b6f575b

                                        Static PE Info

                                        General

                                        Entrypoint:0x5335fe
                                        Entrypoint Section:.text
                                        Digitally signed:false
                                        Imagebase:0x400000
                                        Subsystem:windows gui
                                        Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                        DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                        Time Stamp:0x60ECE62B [Tue Jul 13 01:02:35 2021 UTC]
                                        TLS Callbacks:
                                        CLR (.Net) Version:v4.0.30319
                                        OS Version Major:4
                                        OS Version Minor:0
                                        File Version Major:4
                                        File Version Minor:0
                                        Subsystem Version Major:4
                                        Subsystem Version Minor:0
                                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                        Entrypoint Preview

                                        Instruction
                                        jmp dword ptr [00402000h]
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al

                                        Data Directories

                                        NameVirtual AddressVirtual Size Is in Section
                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x1335a40x57.text
                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x1340000x2200.rsrc
                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x1380000xc.reloc
                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                        Sections

                                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                        .text0x20000x1316040x131800False0.847971115487data7.61581587782IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                        .rsrc0x1340000x22000x2200False0.474954044118data5.89003096224IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                        .reloc0x1380000xc0x200False0.041015625data0.0815394123432IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                        Resources

                                        NameRVASizeTypeLanguageCountry
                                        RT_ICON0x1341300x1024data
                                        RT_GROUP_ICON0x1351540x14data
                                        RT_VERSION0x1351680x2fcdata
                                        RT_MANIFEST0x1354640xd25XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators

                                        Imports

                                        DLLImport
                                        mscoree.dll_CorExeMain

                                        Version Infos

                                        DescriptionData
                                        Translation0x0000 0x04b0
                                        LegalCopyright
                                        Assembly Version1.0.0.0
                                        InternalNameSafeLsaPolicyHand.exe
                                        FileVersion1.0.0.0
                                        CompanyName
                                        LegalTrademarks
                                        Comments
                                        ProductName
                                        ProductVersion1.0.0.0
                                        FileDescription
                                        OriginalFilenameSafeLsaPolicyHand.exe

                                        Network Behavior

                                        Network Port Distribution

                                        TCP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Jul 14, 2021 09:35:52.628036022 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:52.655786991 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:52.657706976 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:52.686177015 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:52.693514109 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:52.721534014 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:52.788518906 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:52.825865984 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:52.825978994 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:52.826230049 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:52.853890896 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:52.853914022 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:52.952632904 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:53.060065031 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:53.089978933 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:53.090007067 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:53.090989113 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:53.122945070 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:53.151575089 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:53.209902048 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:54.205885887 CEST4973780192.168.2.391.199.212.52
                                        Jul 14, 2021 09:35:54.251441956 CEST804973791.199.212.52192.168.2.3
                                        Jul 14, 2021 09:35:54.251749992 CEST4973780192.168.2.391.199.212.52
                                        Jul 14, 2021 09:35:54.279583931 CEST4973780192.168.2.391.199.212.52
                                        Jul 14, 2021 09:35:54.325375080 CEST804973791.199.212.52192.168.2.3
                                        Jul 14, 2021 09:35:54.325414896 CEST804973791.199.212.52192.168.2.3
                                        Jul 14, 2021 09:35:54.325436115 CEST804973791.199.212.52192.168.2.3
                                        Jul 14, 2021 09:35:54.325598001 CEST4973780192.168.2.391.199.212.52
                                        Jul 14, 2021 09:35:54.454888105 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:54.484308958 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:54.486139059 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:54.514178991 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:54.529757977 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:54.563894987 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:54.564508915 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:54.594780922 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:54.595267057 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:54.628005028 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:54.628619909 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:54.657972097 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:54.660993099 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:54.661223888 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:54.661422968 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:54.661521912 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:54.673924923 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:35:54.690023899 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:54.690052986 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:54.706425905 CEST58749736185.26.106.194192.168.2.3
                                        Jul 14, 2021 09:35:54.761907101 CEST49736587192.168.2.3185.26.106.194
                                        Jul 14, 2021 09:36:54.392821074 CEST4973780192.168.2.391.199.212.52
                                        Jul 14, 2021 09:36:54.438581944 CEST804973791.199.212.52192.168.2.3
                                        Jul 14, 2021 09:36:54.439341068 CEST4973780192.168.2.391.199.212.52

                                        UDP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Jul 14, 2021 09:34:14.153791904 CEST6015253192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:14.167798996 CEST53601528.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:15.143529892 CEST5754453192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:15.156552076 CEST53575448.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:16.109354019 CEST5598453192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:16.122440100 CEST53559848.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:17.168165922 CEST6418553192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:17.180888891 CEST53641858.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:17.212044001 CEST6511053192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:17.235883951 CEST53651108.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:17.878555059 CEST5836153192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:17.895771980 CEST53583618.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:18.798983097 CEST6349253192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:18.813405991 CEST53634928.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:19.885710001 CEST6083153192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:19.910291910 CEST53608318.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:21.299381971 CEST6010053192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:21.312798977 CEST53601008.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:23.515237093 CEST5319553192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:23.537030935 CEST53531958.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:24.619398117 CEST5014153192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:24.634793997 CEST53501418.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:26.219448090 CEST5302353192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:26.232230902 CEST53530238.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:27.254019022 CEST4956353192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:27.268445015 CEST53495638.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:28.226284027 CEST5135253192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:28.238859892 CEST53513528.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:30.274197102 CEST5934953192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:30.287271023 CEST53593498.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:31.288048029 CEST5708453192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:31.302531004 CEST53570848.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:43.895723104 CEST5882353192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:43.910121918 CEST53588238.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:44.745511055 CEST5756853192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:44.757719994 CEST53575688.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:45.756835938 CEST5054053192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:45.771595001 CEST53505408.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:50.885093927 CEST5436653192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:50.906476974 CEST53543668.8.8.8192.168.2.3
                                        Jul 14, 2021 09:34:51.007097960 CEST5303453192.168.2.38.8.8.8
                                        Jul 14, 2021 09:34:51.020021915 CEST53530348.8.8.8192.168.2.3
                                        Jul 14, 2021 09:35:21.432971001 CEST5776253192.168.2.38.8.8.8
                                        Jul 14, 2021 09:35:21.463717937 CEST53577628.8.8.8192.168.2.3
                                        Jul 14, 2021 09:35:22.495374918 CEST5543553192.168.2.38.8.8.8
                                        Jul 14, 2021 09:35:22.508961916 CEST53554358.8.8.8192.168.2.3
                                        Jul 14, 2021 09:35:27.864989996 CEST5071353192.168.2.38.8.8.8
                                        Jul 14, 2021 09:35:27.892158985 CEST53507138.8.8.8192.168.2.3
                                        Jul 14, 2021 09:35:38.012465954 CEST5613253192.168.2.38.8.8.8
                                        Jul 14, 2021 09:35:38.031193018 CEST53561328.8.8.8192.168.2.3
                                        Jul 14, 2021 09:35:52.507955074 CEST5898753192.168.2.38.8.8.8
                                        Jul 14, 2021 09:35:52.521961927 CEST53589878.8.8.8192.168.2.3
                                        Jul 14, 2021 09:35:54.149662018 CEST5657953192.168.2.38.8.8.8
                                        Jul 14, 2021 09:35:54.163563967 CEST53565798.8.8.8192.168.2.3
                                        Jul 14, 2021 09:36:11.957442045 CEST6063353192.168.2.38.8.8.8
                                        Jul 14, 2021 09:36:11.991754055 CEST53606338.8.8.8192.168.2.3
                                        Jul 14, 2021 09:36:16.340375900 CEST6129253192.168.2.38.8.8.8
                                        Jul 14, 2021 09:36:16.370692968 CEST53612928.8.8.8192.168.2.3

                                        DNS Queries

                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                        Jul 14, 2021 09:35:22.495374918 CEST192.168.2.38.8.8.80x1959Standard query (0)231.29.2.0.in-addr.arpaPTR (Pointer record)IN (0x0001)
                                        Jul 14, 2021 09:35:52.507955074 CEST192.168.2.38.8.8.80xca54Standard query (0)mail.spamora.netA (IP address)IN (0x0001)
                                        Jul 14, 2021 09:35:54.149662018 CEST192.168.2.38.8.8.80x4c29Standard query (0)crt.sectigo.comA (IP address)IN (0x0001)

                                        DNS Answers

                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                        Jul 14, 2021 09:35:22.508961916 CEST8.8.8.8192.168.2.30x1959Name error (3)231.29.2.0.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)
                                        Jul 14, 2021 09:35:52.521961927 CEST8.8.8.8192.168.2.30xca54No error (0)mail.spamora.net185.26.106.194A (IP address)IN (0x0001)
                                        Jul 14, 2021 09:35:54.163563967 CEST8.8.8.8192.168.2.30x4c29No error (0)crt.sectigo.com91.199.212.52A (IP address)IN (0x0001)

                                        HTTP Request Dependency Graph

                                        • crt.sectigo.com

                                        HTTP Packets

                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                        0192.168.2.34973791.199.212.5280C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        TimestampkBytes transferredDirectionData
                                        Jul 14, 2021 09:35:54.279583931 CEST5271OUTGET /SectigoRSADomainValidationSecureServerCA.crt HTTP/1.1
                                        Connection: Keep-Alive
                                        Accept: */*
                                        User-Agent: Microsoft-CryptoAPI/10.0
                                        Host: crt.sectigo.com
                                        Jul 14, 2021 09:35:54.325414896 CEST5273INHTTP/1.1 200 OK
                                        Server: nginx
                                        Date: Wed, 14 Jul 2021 07:35:54 GMT
                                        Content-Type: application/pkix-cert
                                        Content-Length: 1559
                                        Connection: keep-alive
                                        Last-Modified: Fri, 02 Nov 2018 00:00:00 GMT
                                        ETag: "5bdb9380-617"
                                        X-CCACDN-Mirror-ID: mscrl2
                                        Cache-Control: max-age=14400, s-maxage=3600
                                        X-CCACDN-Proxy-ID: mcdpinlb6
                                        X-Frame-Options: SAMEORIGIN
                                        Accept-Ranges: bytes
                                        Data Raw: 30 82 06 13 30 82 03 fb a0 03 02 01 02 02 10 7d 5b 51 26 b4 76 ba 11 db 74 16 0b bc 53 0d a7 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0c 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 4e 65 77 20 4a 65 72 73 65 79 31 14 30 12 06 03 55 04 07 13 0b 4a 65 72 73 65 79 20 43 69 74 79 31 1e 30 1c 06 03 55 04 0a 13 15 54 68 65 20 55 53 45 52 54 52 55 53 54 20 4e 65 74 77 6f 72 6b 31 2e 30 2c 06 03 55 04 03 13 25 55 53 45 52 54 72 75 73 74 20 52 53 41 20 43 65 72 74 69 66 69 63 61 74 69 6f 6e 20 41 75 74 68 6f 72 69 74 79 30 1e 17 0d 31 38 31 31 30 32 30 30 30 30 30 30 5a 17 0d 33 30 31 32 33 31 32 33 35 39 35 39 5a 30 81 8f 31 0b 30 09 06 03 55 04 06 13 02 47 42 31 1b 30 19 06 03 55 04 08 13 12 47 72 65 61 74 65 72 20 4d 61 6e 63 68 65 73 74 65 72 31 10 30 0e 06 03 55 04 07 13 07 53 61 6c 66 6f 72 64 31 18 30 16 06 03 55 04 0a 13 0f 53 65 63 74 69 67 6f 20 4c 69 6d 69 74 65 64 31 37 30 35 06 03 55 04 03 13 2e 53 65 63 74 69 67 6f 20 52 53 41 20 44 6f 6d 61 69 6e 20 56 61 6c 69 64 61 74 69 6f 6e 20 53 65 63 75 72 65 20 53 65 72 76 65 72 20 43 41 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 d6 73 33 d6 d7 3c 20 d0 00 d2 17 45 b8 d6 3e 07 a2 3f c7 41 ee 32 30 c9 b0 6c fd f4 9f cb 12 98 0f 2d 3f 8d 4d 01 0c 82 0f 17 7f 62 2e e9 b8 48 79 fb 16 83 4e ad d7 32 25 93 b7 07 bf b9 50 3f a9 4c c3 40 2a e9 39 ff d9 81 ca 1f 16 32 41 da 80 26 b9 23 7a 87 20 1e e3 ff 20 9a 3c 95 44 6f 87 75 06 90 40 b4 32 93 16 09 10 08 23 3e d2 dd 87 0f 6f 5d 51 14 6a 0a 69 c5 4f 01 72 69 cf d3 93 4c 6d 04 a0 a3 1b 82 7e b1 9a b9 ed c5 9e c5 37 78 9f 9a 08 34 fb 56 2e 58 c4 09 0e 06 64 5b bc 37 dc f1 9f 28 68 a8 56 b0 92 a3 5c 9f bb 88 98 08 1b 24 1d ab 30 85 ae af b0 2e 9e 7a 9d c1 c0 42 1c e2 02 f0 ea e0 4a d2 ef 90 0e b4 c1 40 16 f0 6f 85 42 4a 64 f7 a4 30 a0 fe bf 2e a3 27 5a 8e 8b 58 b8 ad c3 19 17 84 63 ed 6f 56 fd 83 cb 60 34 c4 74 be e6 9d db e1 e4 e5 ca 0c 5f 15 02 03 01 00 01 a3 82 01 6e 30 82 01 6a 30 1f 06 03 55 1d 23 04 18 30 16 80 14 53 79 bf 5a aa 2b 4a cf 54 80 e1 d8 9b c0 9d f2 b2 03 66 cb 30 1d 06 03 55 1d 0e 04 16 04 14 8d 8c 5e c4 54 ad 8a e1 77 e9 9b f9 9b 05 e1 b8 01 8d 61 e1 30 0e 06 03 55 1d 0f 01 01 ff 04 04 03 02 01 86 30 12 06 03 55 1d 13 01 01 ff 04 08 30 06 01 01 ff 02 01 00 30 1d 06 03 55 1d 25 04 16 30 14 06 08 2b 06 01 05 05 07 03 01 06 08 2b 06 01 05 05 07 03 02 30 1b 06 03 55 1d 20 04 14 30 12 30 06 06 04 55 1d 20 00 30 08 06 06 67 81 0c 01 02 01 30 50 06 03 55 1d 1f 04 49 30 47 30 45 a0 43 a0 41 86 3f 68 74 74 70 3a 2f 2f 63 72 6c 2e 75 73 65 72 74 72 75 73 74 2e 63 6f 6d 2f 55 53 45 52 54 72 75 73 74 52 53 41 43 65 72 74 69 66 69 63 61 74 69 6f 6e 41 75 74 68 6f 72 69 74 79 2e 63 72 6c 30 76 06 08 2b 06 01 05 05 07 01 01 04 6a 30 68 30 3f 06 08 2b 06 01 05 05 07 30 02 86 33 68 74 74 70 3a 2f 2f 63 72 74 2e 75 73 65 72 74 72 75 73 74 2e 63 6f 6d 2f
                                        Data Ascii: 00}[Q&vtS0*H010UUS10UNew Jersey10UJersey City10UThe USERTRUST Network1.0,U%USERTrust RSA Certification Authority0181102000000Z301231235959Z010UGB10UGreater Manchester10USalford10USectigo Limited1705U.Sectigo RSA Domain Validation Secure Server CA0"0*H0s3< E>?A20l-?Mb.HyN2%P?L@*92A&#z <Dou@2#>o]QjiOriLm~7x4V.Xd[7(hV\$0.zBJ@oBJd0.'ZXcoV`4t_n0j0U#0SyZ+JTf0U^Twa0U0U00U%0++0U 00U 0g0PUI0G0ECA?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v+j0h0?+03http://crt.usertrust.com/


                                        SMTP Packets

                                        TimestampSource PortDest PortSource IPDest IPCommands
                                        Jul 14, 2021 09:35:52.686177015 CEST58749736185.26.106.194192.168.2.3220-mail.spamora.net ESMTP Postfix (Debian/GNU)
                                        Jul 14, 2021 09:35:52.693514109 CEST49736587192.168.2.3185.26.106.194EHLO 138727
                                        Jul 14, 2021 09:35:52.788518906 CEST58749736185.26.106.194192.168.2.3220 mail.spamora.net ESMTP Postfix (Debian/GNU)
                                        Jul 14, 2021 09:35:52.825865984 CEST58749736185.26.106.194192.168.2.3250-mail.spamora.net
                                        250-PIPELINING
                                        250-SIZE 80000000
                                        250-VRFY
                                        250-ETRN
                                        250-STARTTLS
                                        250-AUTH PLAIN LOGIN
                                        250-AUTH=PLAIN LOGIN
                                        250-ENHANCEDSTATUSCODES
                                        250-8BITMIME
                                        250 DSN
                                        Jul 14, 2021 09:35:52.826230049 CEST49736587192.168.2.3185.26.106.194STARTTLS
                                        Jul 14, 2021 09:35:52.853914022 CEST58749736185.26.106.194192.168.2.3220 2.0.0 Ready to start TLS

                                        Code Manipulations

                                        Statistics

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        Analysis Process: 5nXX3v5zWn.exe PID: 3440 Parent PID: 5584

                                        General

                                        Start time:09:34:24
                                        Start date:14/07/2021
                                        Path:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        Wow64 process (32bit):true
                                        Commandline:'C:\Users\user\Desktop\5nXX3v5zWn.exe'
                                        Imagebase:0xe60000
                                        File size:1261056 bytes
                                        MD5 hash:E35A0BDB66B37B80C51A1559058E326B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:.Net C# or VB.NET
                                        Reputation:low

                                        Analysis Process: powershell.exe PID: 4116 Parent PID: 3440

                                        General

                                        Start time:09:34:49
                                        Start date:14/07/2021
                                        Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        Wow64 process (32bit):true
                                        Commandline:'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\5nXX3v5zWn.exe'
                                        Imagebase:0x11b0000
                                        File size:430592 bytes
                                        MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:.Net C# or VB.NET
                                        Reputation:high

                                        Analysis Process: conhost.exe PID: 3876 Parent PID: 4116

                                        General

                                        Start time:09:34:49
                                        Start date:14/07/2021
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6b2800000
                                        File size:625664 bytes
                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        Analysis Process: powershell.exe PID: 5796 Parent PID: 3440

                                        General

                                        Start time:09:34:49
                                        Start date:14/07/2021
                                        Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        Wow64 process (32bit):true
                                        Commandline:'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe'
                                        Imagebase:0x11b0000
                                        File size:430592 bytes
                                        MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:.Net C# or VB.NET
                                        Reputation:high

                                        Analysis Process: conhost.exe PID: 592 Parent PID: 5796

                                        General

                                        Start time:09:34:50
                                        Start date:14/07/2021
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6b2800000
                                        File size:625664 bytes
                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        Analysis Process: schtasks.exe PID: 4420 Parent PID: 3440

                                        General

                                        Start time:09:34:50
                                        Start date:14/07/2021
                                        Path:C:\Windows\SysWOW64\schtasks.exe
                                        Wow64 process (32bit):true
                                        Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\egGZqtIOrEmq' /XML 'C:\Users\user\AppData\Local\Temp\tmpA9C5.tmp'
                                        Imagebase:0x1160000
                                        File size:185856 bytes
                                        MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        Analysis Process: conhost.exe PID: 5620 Parent PID: 4420

                                        General

                                        Start time:09:34:51
                                        Start date:14/07/2021
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6b2800000
                                        File size:625664 bytes
                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high

                                        Analysis Process: powershell.exe PID: 2396 Parent PID: 3440

                                        General

                                        Start time:09:34:52
                                        Start date:14/07/2021
                                        Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        Wow64 process (32bit):true
                                        Commandline:'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\egGZqtIOrEmq.exe'
                                        Imagebase:0x11b0000
                                        File size:430592 bytes
                                        MD5 hash:DBA3E6449E97D4E3DF64527EF7012A10
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:.Net C# or VB.NET
                                        Reputation:high

                                        Analysis Process: 5nXX3v5zWn.exe PID: 5712 Parent PID: 3440

                                        General

                                        Start time:09:34:53
                                        Start date:14/07/2021
                                        Path:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        Imagebase:0x330000
                                        File size:1261056 bytes
                                        MD5 hash:E35A0BDB66B37B80C51A1559058E326B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language

                                        Analysis Process: conhost.exe PID: 2428 Parent PID: 2396

                                        General

                                        Start time:09:34:53
                                        Start date:14/07/2021
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6b2800000
                                        File size:625664 bytes
                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language

                                        Analysis Process: 5nXX3v5zWn.exe PID: 3708 Parent PID: 3440

                                        General

                                        Start time:09:34:54
                                        Start date:14/07/2021
                                        Path:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Users\user\Desktop\5nXX3v5zWn.exe
                                        Imagebase:0xb50000
                                        File size:1261056 bytes
                                        MD5 hash:E35A0BDB66B37B80C51A1559058E326B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:.Net C# or VB.NET

                                        Analysis Process: vbc.exe PID: 2440 Parent PID: 3708

                                        General

                                        Start time:09:35:35
                                        Start date:14/07/2021
                                        Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holderwb.txt'
                                        Imagebase:0x400000
                                        File size:1171592 bytes
                                        MD5 hash:C63ED21D5706A527419C9FBD730FFB2E
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language

                                        Analysis Process: vbc.exe PID: 5356 Parent PID: 3708

                                        General

                                        Start time:09:35:35
                                        Start date:14/07/2021
                                        Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext 'C:\Users\user\AppData\Local\Temp\holdermail.txt'
                                        Imagebase:0x400000
                                        File size:1171592 bytes
                                        MD5 hash:C63ED21D5706A527419C9FBD730FFB2E
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language

                                        Analysis Process: WindowsUpdate.exe PID: 5096 Parent PID: 3388

                                        General

                                        Start time:09:35:41
                                        Start date:14/07/2021
                                        Path:C:\Users\user\AppData\Roaming\WindowsUpdate.exe
                                        Wow64 process (32bit):true
                                        Commandline:'C:\Users\user\AppData\Roaming\WindowsUpdate.exe'
                                        Imagebase:0xf90000
                                        File size:1261056 bytes
                                        MD5 hash:E35A0BDB66B37B80C51A1559058E326B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:.Net C# or VB.NET
                                        Antivirus matches:
                                        • Detection: 100%, Joe Sandbox ML
                                        • Detection: 43%, ReversingLabs

                                        Analysis Process: WindowsUpdate.exe PID: 3412 Parent PID: 3388

                                        General

                                        Start time:09:35:50
                                        Start date:14/07/2021
                                        Path:C:\Users\user\AppData\Roaming\WindowsUpdate.exe
                                        Wow64 process (32bit):true
                                        Commandline:'C:\Users\user\AppData\Roaming\WindowsUpdate.exe'
                                        Imagebase:0x260000
                                        File size:1261056 bytes
                                        MD5 hash:E35A0BDB66B37B80C51A1559058E326B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:.Net C# or VB.NET

                                        Disassembly

                                        Code Analysis

                                        Reset < >