Loading ...

Play interactive tourEdit tour

Windows Analysis Report SecuriteInfo.com.MachineLearning.Anomalous.94.14541.14773

Overview

General Information

Sample Name:SecuriteInfo.com.MachineLearning.Anomalous.94.14541.14773 (renamed file extension from 14773 to exe)
Analysis ID:528564
MD5:4ce54eda7650ff0f8062189f089b162e
SHA1:0eaa03d538e574a17ac685b3356816f696e47f4b
SHA256:9246176ddd535c1d48514759ef33e8a129dc6881f685580484a8291940ea5e85
Tags:exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Tries to steal Mail credentials (via file / registry access)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
.NET source code contains potential unpacker
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Contains capabilities to detect virtual machines
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe (PID: 6176 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe" MD5: 4CE54EDA7650FF0F8062189F089B162E)
    • powershell.exe (PID: 7052 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 6120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "m@huiijingco.com", "Password": "lNLUrZT2", "Host": "smtp.huiijingco.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000000.302889154.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000003.00000000.302889154.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000003.00000002.561614573.0000000002AA6000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000003.00000000.302163969.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000003.00000000.302163969.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
            Click to see the 16 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.3730f20.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.3730f20.4.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.6.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 17 entries

                      Sigma Overview

                      System Summary:

                      barindex
                      Sigma detected: Powershell Defender ExclusionShow sources
                      Source: Process startedAuthor: Florian Roth: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe" , ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, ParentProcessId: 6176, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, ProcessId: 7052
                      Sigma detected: Non Interactive PowerShellShow sources
                      Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe" , ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, ParentProcessId: 6176, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, ProcessId: 7052
                      Sigma detected: T1086 PowerShell ExecutionShow sources
                      Source: Pipe createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132823515381024433.7052.DefaultAppDomain.powershell

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "m@huiijingco.com", "Password": "lNLUrZT2", "Host": "smtp.huiijingco.com"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeVirustotal: Detection: 15%Perma Link
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeReversingLabs: Detection: 15%
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.8.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.6.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.12.unpackAvira: Label: TR/Spy.Gen8
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.4.unpackAvira: Label: TR/Spy.Gen8
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561540935.00000000029F1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561540935.00000000029F1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561540935.00000000029F1000.00000004.00000001.sdmpString found in binary or memory: http://XYJLds.com
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp, SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561606326.0000000002A9E000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561540935.00000000029F1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.307311514.000000000360D000.00000004.00000001.sdmp, SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000000.302889154.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561540935.00000000029F1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007b4ABBB2DBu002dDC5Fu002d4430u002d976Au002dBB4790921822u007d/DA284AAAu002dF83Fu002d465Au002dA43Bu002d53A7D878247B.csLarge array initialization: .cctor: array initializer size 11772
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.8.unpack, u003cPrivateImplementationDetailsu003eu007b4ABBB2DBu002dDC5Fu002d4430u002d976Au002dBB4790921822u007d/DA284AAAu002dF83Fu002d465Au002dA43Bu002d53A7D878247B.csLarge array initialization: .cctor: array initializer size 11772
                      Source: 3.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b4ABBB2DBu002dDC5Fu002d4430u002d976Au002dBB4790921822u007d/DA284AAAu002dF83Fu002d465Au002dA43Bu002d53A7D878247B.csLarge array initialization: .cctor: array initializer size 11772
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007b4ABBB2DBu002dDC5Fu002d4430u002d976Au002dBB4790921822u007d/DA284AAAu002dF83Fu002d465Au002dA43Bu002d53A7D878247B.csLarge array initialization: .cctor: array initializer size 11772
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 0_2_009282500_2_00928250
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 0_2_0092D2E80_2_0092D2E8
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 0_2_04C289180_2_04C28918
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 0_2_04C284F40_2_04C284F4
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_00D1AB883_2_00D1AB88
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_00D124003_2_00D12400
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_00D14D003_2_00D14D00
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_00D117F03_2_00D117F0
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_00D1DE483_2_00D1DE48
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_00D1BFD83_2_00D1BFD8
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_00FC46A03_2_00FC46A0
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_00FC45B03_2_00FC45B0
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_05B675403_2_05B67540
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_05B694F83_2_05B694F8
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_05B669283_2_05B66928
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_05B66C703_2_05B66C70
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeBinary or memory string: OriginalFilename vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.310317327.0000000005890000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameUI.dll@ vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.307311514.000000000360D000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameHWxEDVqDRWLfvlztRLwemdtqgYZsGrtZFgpKLP.exe4 vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.307311514.000000000360D000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUI.dll@ vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.309864020.00000000052D0000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameInnerException.dll" vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameInnerException.dll" vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameInnerException.dll" vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameHWxEDVqDRWLfvlztRLwemdtqgYZsGrtZFgpKLP.exe4 vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeBinary or memory string: OriginalFilename vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.558898538.00000000007A8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.558712793.0000000000438000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameHWxEDVqDRWLfvlztRLwemdtqgYZsGrtZFgpKLP.exe4 vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeBinary or memory string: OriginalFilenameKeyValuePairTypeIn.exe. vs SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeVirustotal: Detection: 15%
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeReversingLabs: Detection: 15%
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe:Zone.IdentifierJump to behavior
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe"
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\20211125Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f0qsiy5n.jol.ps1Jump to behavior
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@6/4@0/0
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6120:120:WilError_01
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeString found in binary or memory: /KeyValuePairTypeIn;component/views/addbook.xaml
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeString found in binary or memory: views/addbook.baml
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeString found in binary or memory: views/addcustomer.baml
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeString found in binary or memory: /KeyValuePairTypeIn;component/views/addcustomer.xaml
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeString found in binary or memory: /KeyValuePairTypeIn;component/views/addbook.xaml
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeString found in binary or memory: views/addcustomer.baml
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeString found in binary or memory: views/addbook.baml
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeString found in binary or memory: /KeyValuePairTypeIn;component/views/addcustomer.xaml
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeString found in binary or memory: a/KeyValuePairTypeIn;component/views/addbook.xamlw/KeyValuePairTypeIn;component/views/borrowfrombookview.xamlm/KeyValuePairTypeIn;component/views/borrowingview.xamlg/KeyValuePairTypeIn;component/views/changebook.xamlo/KeyValuePairTypeIn;component/views/changecustomer.xamlk/KeyValuePairTypeIn;component/views/customerview.xamlo/KeyValuePairTypeIn;component/views/deletecustomer.xamle/KeyValuePairTypeIn;component/views/errorview.xamli/KeyValuePairTypeIn;component/views/smallextras.xamli/KeyValuePairTypeIn;component/views/addcustomer.xaml
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeString found in binary or memory: *images/booksimage.jpg$views/addbook.baml1J,views/addcustomer.baml
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.10.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.8.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.8.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 3.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 3.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                      Data Obfuscation:

                      barindex
                      .NET source code contains potential unpackerShow sources
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 0.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.a0000.0.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.a0000.0.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.5a0000.0.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.5a0000.5.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.5a0000.9.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.5a0000.3.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 3.0.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.5a0000.11.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: 3.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.5a0000.1.unpack, Biblan/Views/MainWindow.cs.Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 0_2_000A9347 push ds; ret 0_2_000A934C
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 0_2_000A9361 push ds; retf 0_2_000A9364
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 0_2_000A92F5 push ds; ret 0_2_000A9340
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_005A9347 push ds; ret 3_2_005A934C
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_005A92F5 push ds; ret 3_2_005A9340
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_005A9361 push ds; retf 3_2_005A9364
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_00D1EB90 push eax; retf 3_2_00D1EB91
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_05B60402 push E801035Eh; ret 3_2_05B60409
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_05B603F7 push E802005Eh; retf 3_2_05B60401
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.8787752496
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.2669094.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe.26fc110.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe PID: 6176, type: MEMORYSTR
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp, SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmp, SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
                      Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeWMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -6456360425798339s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -240000s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6260Thread sleep count: 1553 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -239843s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6276Thread sleep time: -38337s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -239733s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6260Thread sleep count: 2179 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -239621s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -239499s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -239390s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -239281s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -239171s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -239000s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -238875s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -238765s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -238623s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -238515s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -238406s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -238296s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -238185s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -238077s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -237953s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -237843s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -237733s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -237623s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -237514s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -237385s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -237249s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -237109s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -236946s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -236821s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -236406s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -235406s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -234406s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6288Thread sleep time: -234264s >= -30000sJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4024Thread sleep time: -8301034833169293s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6236Thread sleep time: -16602069666338586s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6240Thread sleep count: 1350 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe TID: 6240Thread sleep count: 8475 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 240000Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239843Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239733Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239621Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239499Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239390Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239281Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239171Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239000Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238875Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238765Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238623Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238515Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238406Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238296Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238185Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238077Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237953Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237843Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237733Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237623Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237514Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237385Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237249Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237109Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 236946Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 236821Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 236406Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 235406Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 234406Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 234264Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeWindow / User API: threadDelayed 1553Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeWindow / User API: threadDelayed 2179Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5548Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2922Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeWindow / User API: threadDelayed 1350Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeWindow / User API: threadDelayed 8475Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: IdentifierJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 240000Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239843Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 38337Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239733Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239621Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239499Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239390Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239281Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239171Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 239000Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238875Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238765Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238623Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238515Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238406Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238296Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238185Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 238077Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237953Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237843Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237733Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237623Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237514Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237385Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237249Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 237109Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 236946Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 236821Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 236406Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 235406Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 234406Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 234264Jump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.310715504.0000000006AD0000.00000004.00000001.sdmpBinary or memory string: VMware
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmpBinary or memory string: pl"SOFTWARE\VMware, Inc.\VMware T<
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmpBinary or memory string: pl"SOFTWARE\VMware, Inc.\VMware T
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmpBinary or memory string: VMWARE
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmpBinary or memory string: pl"SOFTWARE\VMware, Inc.\VMware Tools
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.310715504.0000000006AD0000.00000004.00000001.sdmpBinary or memory string: Win32_VideoController(Standard display types)VMwareUCTT_MD9Win32_VideoController4GALLHDCVideoController120060621000000.000000-00066824200display.infMSBDA1R4STXWMPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsS2_48PSX]
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmpBinary or memory string: pl%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306897551.00000000026CB000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000000.00000002.306734942.0000000002601000.00000004.00000001.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeCode function: 3_2_00D1ECC0 LdrInitializeThunk,3_2_00D1ECC0
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Adds a directory exclusion to Windows DefenderShow sources
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeJump to behavior
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561005106.0000000001380000.00000002.00020000.sdmpBinary or memory string: Program Manager
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561005106.0000000001380000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561005106.0000000001380000.00000002.00020000.sdmpBinary or memory string: Progman
                      Source: SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe, 00000003.00000002.561005106.0000000001380000.00000002.00020000.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\SecuriteInfo.com.MachineLearning.Anomalous.94.14541.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation