Windows Analysis Report
SecuriteInfo.com.Variant.Tedy.122593.7296.5298

Overview

General Information

Sample Name: SecuriteInfo.com.Variant.Tedy.122593.7296.5298 (renamed file extension from 5298 to exe)
Analysis ID: 631411
MD5: a3f9db216c595bbb5081ad0430248975
SHA1: e06a7da7340e4e27d9737e58554ab4419116a0e2
SHA256: 647c540fe4c9f3dc5a06c978ff0644905b07a53517e637f674a089f866a135d0
Tags: exe
Infos:

Detection

Nanocore
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected UAC Bypass using CMSTP
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Sigma detected: NanoCore
Yara detected AntiVM3
Detected Nanocore Rat
Multi AV Scanner detection for dropped file
Yara detected Nanocore RAT
.NET source code references suspicious native API functions
Contains functionality to hide user accounts
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Changes security center settings (notifications, updates, antivirus, firewall)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Adds a directory exclusion to Windows Defender
Creates autostart registry keys with suspicious names
Hides that the sample has been downloaded from the Internet (zone.identifier)
Uses dynamic DNS services
Drops PE files with benign system names
Uses 32bit PE files
Uses a Windows Living Off The Land Binaries (LOL bins)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
AV process strings found (often used to terminate AV products)
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Detected TCP or UDP traffic on non-standard ports
Contains capabilities to detect virtual machines
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Virustotal: Detection: 27% Perma Link
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe ReversingLabs: Detection: 30%
Multi AV Scanner detection for dropped file
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Virustotal: Detection: 27% Perma Link
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe ReversingLabs: Detection: 30%
Yara detected Nanocore RAT
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6bfc468.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70bc468.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feb136.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6bfc468.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c1c488.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c5c4a8.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c1c488.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3ff4595.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70dc488.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70bc468.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c5c4a8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70dc488.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.711c4a8.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.711c4a8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b04629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.316156238.0000000004353000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.401214129.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.467575760.0000000006BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.470009001.0000000003E39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.521932129.0000000003FDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.409476455.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.453759641.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.431477381.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.457356006.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.435945943.0000000003EF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.388245594.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.417950863.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.480782499.0000000006E05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.436394242.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.434616704.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.397560110.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.409560894.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.430068094.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.475336457.0000000006D35000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.396951247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.412903309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002A.00000002.498775131.000000000770E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.408440713.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.290964179.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.514934188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.520502243.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.419417648.0000000007095000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002A.00000002.499618859.000000000776E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.378546866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.523441756.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.468107743.0000000006C5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.291890743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.468173514.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.316607101.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.377509658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.426838384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.293158040.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.293766876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.412427457.0000000004099000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.425602291.000000000711C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.398877683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.377041236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.411222280.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.455871572.0000000003411000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.480982915.0000000006E8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.412196132.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.469838509.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.475452157.0000000006DBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 6272, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 7096, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 2988, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 1472, type: MEMORYSTR
Antivirus or Machine Learning detection for unpacked file
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.unpack Avira: Label: TR/NanoCore.fadte

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.42ee2b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.4b8e2b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.470e2b8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000003.335858540.00000000043D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.336568726.0000000004470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.335893523.00000000043D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.455661401.0000000004826000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.335918255.00000000043D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.437946042.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.315747535.00000000042C6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.336643392.0000000004470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.398758851.0000000003121000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.407528088.0000000004B66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.336599180.0000000004470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.336631012.0000000004470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002A.00000002.492650397.00000000051B6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.416839988.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.455177342.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.335926061.00000000043D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.336584022.0000000004470000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.474526157.0000000004926000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 6272, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 2988, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 1472, type: MEMORYSTR
Source: Yara match File source: C:\Windows\Temp\jcxc0kzm.inf, type: DROPPED
Source: Yara match File source: C:\Windows\Temp\hhhnf0tr.inf, type: DROPPED
Source: Yara match File source: C:\Windows\Temp\y5zio4ie.inf, type: DROPPED
Source: Yara match File source: C:\Windows\Temp\axo2mpum.inf, type: DROPPED
Uses 32bit PE files
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Directory created: C:\Program Files\Common Files\System\9f3df393cbbd19b Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Directory created: C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe Jump to behavior
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Binary string: c:\BuildAgent\work\485425247c27f279\RuntimeRelease\src\Microsoft.Owin.Host.HttpListener\obj\net45\Release\Microsoft.Owin.Host.HttpListener.pdb source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000A.00000000.283112397.0000000000C32000.00000020.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000000.288765429.0000000000C32000.00000020.00000001.01000000.00000003.sdmp, svchost.exe, svchost.exe, 00000013.00000002.414384522.0000000006C01000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.407528088.0000000004B66000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.407028015.000000000417A000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.397600705.0000000000A22000.00000020.00000001.01000000.00000006.sdmp, svchost.exe, 00000013.00000000.301566372.0000000000A22000.00000020.00000001.01000000.00000006.sdmp, svchost.exe, 00000014.00000002.413516155.0000000000A22000.00000020.00000001.01000000.00000006.sdmp, svchost.exe, 00000014.00000000.318432134.0000000000A22000.00000020.00000001.01000000.00000006.sdmp, svchost.exe, 00000014.00000002.454271439.0000000006741000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.439228512.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: er.pdb source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.519619122.00000000013A5000.00000004.00000020.00020000.00000000.sdmp

Networking
barindex
Uses dynamic DNS services
Source: unknown DNS query: name: nwme22.duckdns.org
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49745 -> 185.220.69.56:6662
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.309880319.0000000002881000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.520502243.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.398758851.0000000003121000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.416839988.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: svchost.exe, 00000010.00000002.320172943.000001B85D013000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 0000000E.00000002.516856000.00000200E023E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 0000000E.00000002.516856000.00000200E023E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 0000000E.00000002.516856000.00000200E023E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000E.00000002.516856000.00000200E023E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.comr
Source: svchost.exe, 00000010.00000003.319128104.000001B85D060000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000000E.00000002.516856000.00000200E023E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000E.00000002.516856000.00000200E023E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000010.00000003.319249361.000001B85D05A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000010.00000003.319249361.000001B85D05A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.320589594.000001B85D05C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000010.00000003.319128104.000001B85D060000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000010.00000002.320385796.000001B85D03C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000010.00000003.319249361.000001B85D05A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.320589594.000001B85D05C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000010.00000003.318956837.000001B85D067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.320630781.000001B85D06A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000010.00000003.319128104.000001B85D060000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000010.00000003.319483204.000001B85D047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.320562765.000001B85D04E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000010.00000003.319249361.000001B85D05A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.320589594.000001B85D05C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000010.00000003.319128104.000001B85D060000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000010.00000002.320385796.000001B85D03C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000010.00000003.319128104.000001B85D060000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000010.00000003.319128104.000001B85D060000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000010.00000003.319128104.000001B85D060000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000010.00000003.297198932.000001B85D030000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000010.00000002.320517816.000001B85D042000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000010.00000003.319630514.000001B85D040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.320517816.000001B85D042000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000010.00000003.319128104.000001B85D060000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000010.00000003.319249361.000001B85D05A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000003.319630514.000001B85D040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.320589594.000001B85D05C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000010.00000003.319249361.000001B85D05A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000010.00000003.319249361.000001B85D05A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.320589594.000001B85D05C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000010.00000003.319249361.000001B85D05A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.320589594.000001B85D05C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000010.00000002.320562765.000001B85D04E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000010.00000003.319128104.000001B85D060000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000010.00000002.320385796.000001B85D03C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000010.00000003.297198932.000001B85D030000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000010.00000002.320385796.000001B85D03C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000010.00000002.320385796.000001B85D03C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.320172943.000001B85D013000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000010.00000003.297198932.000001B85D030000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000010.00000003.319613001.000001B85D045000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000010.00000003.297198932.000001B85D030000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000010.00000003.297198932.000001B85D030000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.320370067.000001B85D039000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000010.00000003.319483204.000001B85D047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.320562765.000001B85D04E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: unknown DNS traffic detected: queries for: nwme22.duckdns.org
Creates a DirectInput object (often for capturing keystrokes)
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.309570041.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Installs a raw input device (often for capturing keystrokes)
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.521932129.0000000003FDB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: RegisterRawInputDevices

E-Banking Fraud
barindex
Yara detected Nanocore RAT
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6bfc468.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70bc468.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feb136.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6bfc468.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c1c488.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c5c4a8.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c1c488.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3ff4595.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70dc488.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70bc468.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c5c4a8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70dc488.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.711c4a8.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.711c4a8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b04629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.316156238.0000000004353000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.401214129.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.467575760.0000000006BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.470009001.0000000003E39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.521932129.0000000003FDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.409476455.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.453759641.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.431477381.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.457356006.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.435945943.0000000003EF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.388245594.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.417950863.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.480782499.0000000006E05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.436394242.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.434616704.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.397560110.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.409560894.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.430068094.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.475336457.0000000006D35000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.396951247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.412903309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002A.00000002.498775131.000000000770E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.408440713.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.290964179.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.514934188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.520502243.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.419417648.0000000007095000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002A.00000002.499618859.000000000776E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.378546866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.523441756.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.468107743.0000000006C5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.291890743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.468173514.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.316607101.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.377509658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.426838384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.293158040.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.293766876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.412427457.0000000004099000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.425602291.000000000711C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.398877683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.377041236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.411222280.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.455871572.0000000003411000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.480982915.0000000006E8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.412196132.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.469838509.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.475452157.0000000006DBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 6272, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 7096, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 2988, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 1472, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.svchost.exe.6bfc468.10.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.svchost.exe.6bfc468.10.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.svchost.exe.6bfc468.10.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.svchost.exe.70bc468.9.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.svchost.exe.70bc468.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 19.2.svchost.exe.70bc468.9.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feb136.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feb136.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feb136.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.svchost.exe.6bfc468.10.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.svchost.exe.6bfc468.10.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.svchost.exe.6bfc468.10.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.svchost.exe.6c1c488.9.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.svchost.exe.6c1c488.9.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.svchost.exe.6c1c488.9.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.2fccc1c.2.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.2fccc1c.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.svchost.exe.6c5c4a8.11.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.svchost.exe.6c5c4a8.11.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.svchost.exe.6c5c4a8.11.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.svchost.exe.6c1c488.9.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.svchost.exe.6c1c488.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.svchost.exe.6c1c488.9.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.57d0000.6.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.57d0000.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3ff4595.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3ff4595.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 19.2.svchost.exe.70dc488.10.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.svchost.exe.70dc488.10.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 19.2.svchost.exe.70dc488.10.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.svchost.exe.70bc468.9.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.svchost.exe.70bc468.9.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 19.2.svchost.exe.70bc468.9.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 20.2.svchost.exe.6c5c4a8.11.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 20.2.svchost.exe.6c5c4a8.11.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 20.2.svchost.exe.6c5c4a8.11.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.svchost.exe.70dc488.10.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.svchost.exe.70dc488.10.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 19.2.svchost.exe.70dc488.10.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.svchost.exe.711c4a8.11.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.svchost.exe.711c4a8.11.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 19.2.svchost.exe.711c4a8.11.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.svchost.exe.711c4a8.11.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 19.2.svchost.exe.711c4a8.11.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 19.2.svchost.exe.711c4a8.11.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b04629.7.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b04629.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.42ee2b8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.42ee2b8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects NanoCore Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 19.2.svchost.exe.4b8e2b8.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 19.2.svchost.exe.4b8e2b8.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 20.2.svchost.exe.470e2b8.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 20.2.svchost.exe.470e2b8.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 00000000.00000002.316156238.0000000004353000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.316156238.0000000004353000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000024.00000000.401214129.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000024.00000000.401214129.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000014.00000002.467575760.0000000006BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.467575760.0000000006BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000029.00000002.470009001.0000000003E39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.521932129.0000000003FDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000027.00000000.409476455.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000027.00000000.409476455.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000027.00000002.453759641.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000027.00000002.453759641.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000029.00000000.431477381.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000029.00000000.431477381.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000027.00000002.457356006.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000024.00000002.435945943.0000000003EF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001F.00000000.388245594.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001F.00000000.388245594.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000029.00000000.417950863.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000029.00000000.417950863.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001D.00000002.480782499.0000000006E05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001D.00000002.480782499.0000000006E05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000029.00000000.436394242.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000029.00000000.436394242.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.523274728.00000000057D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000002.523274728.00000000057D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000024.00000002.434616704.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000024.00000000.397560110.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000024.00000000.397560110.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001F.00000002.409560894.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001F.00000002.409560894.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000024.00000002.430068094.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000024.00000002.430068094.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000017.00000002.475336457.0000000006D35000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000017.00000002.475336457.0000000006D35000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000024.00000000.396951247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000024.00000000.396951247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000027.00000000.412903309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000027.00000000.412903309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000002A.00000002.498775131.000000000770E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000002A.00000002.498775131.000000000770E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000027.00000000.408440713.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000027.00000000.408440713.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000000.290964179.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000000.290964179.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.514934188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000002.514934188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000002.419417648.0000000007095000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000002.419417648.0000000007095000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000002A.00000002.499618859.000000000776E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000002A.00000002.499618859.000000000776E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001F.00000000.378546866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001F.00000000.378546866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000002.523441756.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000002.523441756.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects NanoCore Author: ditekSHen
Source: 00000014.00000002.468107743.0000000006C5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000014.00000002.468107743.0000000006C5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000000.291890743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000000.291890743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000029.00000002.468173514.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000029.00000002.468173514.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.316607101.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.316607101.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001F.00000000.377509658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001F.00000000.377509658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000029.00000000.426838384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000029.00000000.426838384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000000.293158040.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000000.293158040.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000000.293766876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000000.293766876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001F.00000002.412427457.0000000004099000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000013.00000002.425602291.000000000711C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000013.00000002.425602291.000000000711C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000024.00000000.398877683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000024.00000000.398877683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001F.00000000.377041236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001F.00000000.377041236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000027.00000000.411222280.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000027.00000000.411222280.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000027.00000002.455871572.0000000003411000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001D.00000002.480982915.0000000006E8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001D.00000002.480982915.0000000006E8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001F.00000002.412196132.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000029.00000002.469838509.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000017.00000002.475452157.0000000006DBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000017.00000002.475452157.0000000006DBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 6272, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 6272, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 7096, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 7096, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: svchost.exe PID: 2988, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: svchost.exe PID: 2988, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: svchost.exe PID: 1472, type: MEMORYSTR Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: svchost.exe PID: 1472, type: MEMORYSTR Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Uses 32bit PE files
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Uses a Windows Living Off The Land Binaries (LOL bins)
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\hhhnf0tr.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\y5zio4ie.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\jcxc0kzm.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\axo2mpum.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\w3wzxqls.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\4khuvn4f.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\y4qcuvyd.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\nws2q1vp.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\hhhnf0tr.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\y5zio4ie.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\jcxc0kzm.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\axo2mpum.inf
Yara signature match
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 20.2.svchost.exe.6bfc468.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 20.2.svchost.exe.6bfc468.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.svchost.exe.6bfc468.10.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.svchost.exe.6bfc468.10.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.svchost.exe.70bc468.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.svchost.exe.70bc468.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.2.svchost.exe.70bc468.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 19.2.svchost.exe.70bc468.9.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feb136.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feb136.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feb136.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feb136.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.svchost.exe.6bfc468.10.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 20.2.svchost.exe.6bfc468.10.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.svchost.exe.6bfc468.10.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.svchost.exe.6bfc468.10.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 20.2.svchost.exe.6c1c488.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 20.2.svchost.exe.6c1c488.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.svchost.exe.6c1c488.9.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.svchost.exe.6c1c488.9.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.2fccc1c.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.2fccc1c.2.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.2fccc1c.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.svchost.exe.6c5c4a8.11.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 20.2.svchost.exe.6c5c4a8.11.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.svchost.exe.6c5c4a8.11.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.svchost.exe.6c5c4a8.11.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 20.2.svchost.exe.6c1c488.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 20.2.svchost.exe.6c1c488.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 20.2.svchost.exe.6c1c488.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.svchost.exe.6c1c488.9.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.svchost.exe.3cfad58.1.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.57d0000.6.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.57d0000.6.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.57d0000.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3ff4595.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3ff4595.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3ff4595.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 19.2.svchost.exe.70dc488.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.svchost.exe.70dc488.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.2.svchost.exe.70dc488.10.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 19.2.svchost.exe.70dc488.10.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.svchost.exe.70bc468.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.svchost.exe.70bc468.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.2.svchost.exe.70bc468.9.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 19.2.svchost.exe.70bc468.9.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 20.2.svchost.exe.6c5c4a8.11.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 20.2.svchost.exe.6c5c4a8.11.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 20.2.svchost.exe.6c5c4a8.11.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.svchost.exe.417a738.1.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 19.2.svchost.exe.70dc488.10.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.svchost.exe.70dc488.10.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.2.svchost.exe.70dc488.10.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 19.2.svchost.exe.70dc488.10.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.svchost.exe.711c4a8.11.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.svchost.exe.711c4a8.11.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 19.2.svchost.exe.711c4a8.11.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 19.2.svchost.exe.711c4a8.11.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.svchost.exe.711c4a8.11.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 19.2.svchost.exe.711c4a8.11.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 19.2.svchost.exe.711c4a8.11.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b04629.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b04629.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b04629.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.42ee2b8.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.42ee2b8.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 19.2.svchost.exe.4b8e2b8.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 19.2.svchost.exe.4b8e2b8.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 20.2.svchost.exe.470e2b8.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 20.2.svchost.exe.470e2b8.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 00000000.00000002.316156238.0000000004353000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.316156238.0000000004353000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000024.00000000.401214129.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000024.00000000.401214129.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000014.00000002.467575760.0000000006BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000014.00000002.467575760.0000000006BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000029.00000002.470009001.0000000003E39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000002.521932129.0000000003FDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000027.00000000.409476455.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000027.00000000.409476455.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000027.00000002.453759641.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000027.00000002.453759641.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000029.00000000.431477381.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000029.00000000.431477381.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000027.00000002.457356006.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000024.00000002.435945943.0000000003EF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001F.00000000.388245594.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001F.00000000.388245594.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000029.00000000.417950863.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000029.00000000.417950863.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001D.00000002.480782499.0000000006E05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001D.00000002.480782499.0000000006E05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000029.00000000.436394242.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000029.00000000.436394242.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000002.523274728.00000000057D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000002.523274728.00000000057D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0000000B.00000002.523274728.00000000057D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000024.00000002.434616704.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000024.00000000.397560110.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000024.00000000.397560110.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001F.00000002.409560894.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001F.00000002.409560894.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000024.00000002.430068094.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000024.00000002.430068094.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000017.00000002.475336457.0000000006D35000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000017.00000002.475336457.0000000006D35000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000024.00000000.396951247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000024.00000000.396951247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000027.00000000.412903309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000027.00000000.412903309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000002A.00000002.498775131.000000000770E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000002A.00000002.498775131.000000000770E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000027.00000000.408440713.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000027.00000000.408440713.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000000.290964179.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000000.290964179.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000002.514934188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000002.514934188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000002.419417648.0000000007095000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000002.419417648.0000000007095000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000002A.00000002.499618859.000000000776E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000002A.00000002.499618859.000000000776E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001F.00000000.378546866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001F.00000000.378546866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000002.523441756.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000002.523441756.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0000000B.00000002.523441756.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 00000014.00000002.468107743.0000000006C5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000014.00000002.468107743.0000000006C5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000000.291890743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000000.291890743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000029.00000002.468173514.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000029.00000002.468173514.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.316607101.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.316607101.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001F.00000000.377509658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001F.00000000.377509658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000029.00000000.426838384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000029.00000000.426838384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000000.293158040.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000000.293158040.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000000.293766876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000000.293766876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001F.00000002.412427457.0000000004099000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000013.00000002.425602291.000000000711C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000013.00000002.425602291.000000000711C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000024.00000000.398877683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000024.00000000.398877683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001F.00000000.377041236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001F.00000000.377041236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000027.00000000.411222280.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000027.00000000.411222280.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000027.00000002.455871572.0000000003411000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001D.00000002.480982915.0000000006E8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001D.00000002.480982915.0000000006E8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001F.00000002.412196132.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000029.00000002.469838509.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000017.00000002.475452157.0000000006DBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000017.00000002.475452157.0000000006DBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 6272, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 6272, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 7096, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 7096, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: svchost.exe PID: 2988, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: svchost.exe PID: 2988, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: svchost.exe PID: 1472, type: MEMORYSTR Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: svchost.exe PID: 1472, type: MEMORYSTR Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Code function: 0_2_00BE6090 0_2_00BE6090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Code function: 0_2_00BE4548 0_2_00BE4548
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Code function: 0_2_00BEB3D0 0_2_00BEB3D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Code function: 0_2_00BED418 0_2_00BED418
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Code function: 0_2_00BE4538 0_2_00BE4538
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Code function: 0_2_00BE9728 0_2_00BE9728
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Code function: 0_2_00BED910 0_2_00BED910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Code function: 0_2_048B0420 0_2_048B0420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Code function: 0_2_048B66F8 0_2_048B66F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Code function: 11_2_0181E480 11_2_0181E480
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Code function: 11_2_0181E471 11_2_0181E471
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Code function: 11_2_0181BBD4 11_2_0181BBD4
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_0515C6B8 19_2_0515C6B8
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_051501A0 19_2_051501A0
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_0515AAB8 19_2_0515AAB8
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_05664548 19_2_05664548
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_0566D418 19_2_0566D418
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_0566B3D0 19_2_0566B3D0
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_05664538 19_2_05664538
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_05665F50 19_2_05665F50
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_0566D910 19_2_0566D910
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E4D48 19_2_057E4D48
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E8CD9 19_2_057E8CD9
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E1499 19_2_057E1499
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057EA708 19_2_057EA708
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E3EE0 19_2_057E3EE0
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E16D0 19_2_057E16D0
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E7A47 19_2_057E7A47
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E5AA0 19_2_057E5AA0
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E1F70 19_2_057E1F70
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E1E50 19_2_057E1E50
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E1E40 19_2_057E1E40
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E3398 19_2_057E3398
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E1A38 19_2_057E1A38
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E1A33 19_2_057E1A33
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_00BF4548 20_2_00BF4548
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_00BF8C12 20_2_00BF8C12
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_00BFB3D0 20_2_00BFB3D0
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_00BFD418 20_2_00BFD418
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_00BF4538 20_2_00BF4538
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_00BF9728 20_2_00BF9728
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_00BFD910 20_2_00BFD910
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_00BF5F50 20_2_00BF5F50
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CEA478 20_2_04CEA478
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE0C0B 20_2_04CE0C0B
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE0C18 20_2_04CE0C18
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_05494D48 20_2_05494D48
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_05498C10 20_2_05498C10
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_05491F70 20_2_05491F70
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_05493EE0 20_2_05493EE0
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_0549F9A8 20_2_0549F9A8
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_05493398 20_2_05493398
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_05497A58 20_2_05497A58
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_05491A38 20_2_05491A38
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_05491A32 20_2_05491A32
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_05495AA0 20_2_05495AA0
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_08A24F00 20_2_08A24F00
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_08A26590 20_2_08A26590
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_08A24630 20_2_08A24630
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.309326447.0000000000D14000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameMicrosoft.Owin.Host.HttpListener.dll@ vs SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.316156238.0000000004353000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGeHn EQX.exe2 vs SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.316607101.00000000043DA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameGeHn EQX.exe2 vs SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.315208648.0000000003889000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMicrosoft.Owin.Host.HttpListener.dll@ vs SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.307658556.00000000008F7000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.309570041.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000A.00000000.281101599.0000000000D14000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameMicrosoft.Owin.Host.HttpListener.dll@ vs SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.521932129.0000000003FDB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameClientPlugin.dll4 vs SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.521932129.0000000003FDB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameLzma#.dll4 vs SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.521932129.0000000003FDB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSurveillanceExClientPlugin.dll4 vs SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000000.291307742.0000000000D14000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameMicrosoft.Owin.Host.HttpListener.dll@ vs SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.519501305.000000000137A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.520502243.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameClientPlugin.dll4 vs SecuriteInfo.com.Variant.Tedy.122593.7296.exe
PE file contains strange resources
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: svchost.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: svchost.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: svchost.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Windows\System32\svchost.exe Section loaded: xboxlivetitleid.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cdpsgshims.dll
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Virustotal: Detection: 27%
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe ReversingLabs: Detection: 30%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Jump to behavior
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe" -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe" -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe" -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown Process created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe"
Source: unknown Process created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe"
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\hhhnf0tr.inf
Source: unknown Process created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe"
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\y5zio4ie.inf
Source: unknown Process created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe"
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\jcxc0kzm.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\axo2mpum.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\w3wzxqls.inf
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\4khuvn4f.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\y4qcuvyd.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\nws2q1vp.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe
Source: unknown Process created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe" -Force Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe" -Force Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe" -Force Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: unknown unknown
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\hhhnf0tr.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\y5zio4ie.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\jcxc0kzm.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\axo2mpum.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Variant.Tedy.122593.7296.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_imah35ms.0df.ps1 Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winEXE@46/16@2/3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, u0037171791c1b9f1c3/u00391fd97c133371c3.cs Base64 encoded string: 'QW1uI381eyd4e2N4Y2NrfWMxYXB8cHJidHx+O3pybD9SRE5GRVZDCQ==', 'QW8iZnZ3aXUoZmloeX9razBmenp4cDZ7d3h+cnJ6JGQQXFkSWV4WWlMbVw==', 'QXNnI31qcyd7fHhuLHRhejBmc31gNWJ4OHZsfm5qbHZURAJYFFgZ', 'VGlrcCRxaWhkKWN4LH56Znx9Mnp6NXJybnx2dGxwe3FUDwJqUAJVB1hbRUlNT0JWEFNHVFNMOz1ZV14bUVxHHyMuMDExNTJnMSY/OWw+Lzk1InxzEDo4cCx5NS05LyktCRUHQwULH2piDBICHxkHARdRARICEBEWFRwJWwkTEhrz8qL66/Cm5vrsqu3p6OLm/vay5fHn77f66/vt+bM='
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, u003773d1bc997c9bb3/f7bb7d1ffd73c73.cs Base64 encoded string: 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg=='
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, fdc1131dcd7fbdc/u003197b393f33dfdbf.cs Base64 encoded string: 'UEBRYnJgQ2NhfWV5LHY+chpzazNZdGJhfXA6SGh4eH5STlQpQkpUB3hbQ1hDQw5uQlJaWkBQVUMYQgtGNjdWSzQxMXlraiEuPCE/KWIuISJ/NyAyMzgzJXcJGwg9KzsaBAgWDBY='
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, dbd9bcf91cfcc9f/bb9c3b7ddd9c31d.cs Base64 encoded string: 'SHV2c0hsdXNtZ295LCNASkQxJj0hOTZacXpodG9yeGsOblVKSgtuSFtdBGNYWV5jWUJGVlpQRBcKFwoVDBMO', 'Tm4iVGFnVWhrYm9/LH57f2B+YGc0cXNjfXpufngxPkhJT0ZMU1YGHwhGWAtATFpKQhFbQBRHU0ZNUEheWBM='
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, u0037171791c1b9f1c3/u00319d7f73f91fb1fd.cs Base64 encoded string: 'VW9ne3RgZXNtbSpleWBsamIxfXU0YXl8fXdpO3VzPn5OAUtNSExIQghHRU9JDUpKVlhcWkBcWVkYVlQbUFRQWmA=', 'VW9ne3RgZXNtbSpuYmkuYHYxe314fHhyOHd1f3k9enpGSExKUExJSQhGRAtAREBKEA=='
Source: svchost.exe.0.dr, u003773d1bc997c9bb3/f7bb7d1ffd73c73.cs Base64 encoded string: 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg=='
Source: svchost.exe.0.dr, dbd9bcf91cfcc9f/bb9c3b7ddd9c31d.cs Base64 encoded string: 'SHV2c0hsdXNtZ295LCNASkQxJj0hOTZacXpodG9yeGsOblVKSgtuSFtdBGNYWV5jWUJGVlpQRBcKFwoVDBMO', 'Tm4iVGFnVWhrYm9/LH57f2B+YGc0cXNjfXpufngxPkhJT0ZMU1YGHwhGWAtATFpKQhFbQBRHU0ZNUEheWBM='
Source: svchost.exe.0.dr, fdc1131dcd7fbdc/u003197b393f33dfdbf.cs Base64 encoded string: 'UEBRYnJgQ2NhfWV5LHY+chpzazNZdGJhfXA6SGh4eH5STlQpQkpUB3hbQ1hDQw5uQlJaWkBQVUMYQgtGNjdWSzQxMXlraiEuPCE/KWIuISJ/NyAyMzgzJXcJGwg9KzsaBAgWDBY='
Source: svchost.exe.0.dr, u0037171791c1b9f1c3/u00319d7f73f91fb1fd.cs Base64 encoded string: 'VW9ne3RgZXNtbSpleWBsamIxfXU0YXl8fXdpO3VzPn5OAUtNSExIQghHRU9JDUpKVlhcWkBcWVkYVlQbUFRQWmA=', 'VW9ne3RgZXNtbSpuYmkuYHYxe314fHhyOHd1f3k9enpGSExKUExJSQhGRAtAREBKEA=='
Source: svchost.exe.0.dr, u0037171791c1b9f1c3/u00391fd97c133371c3.cs Base64 encoded string: 'QW1uI381eyd4e2N4Y2NrfWMxYXB8cHJidHx+O3pybD9SRE5GRVZDCQ==', 'QW8iZnZ3aXUoZmloeX9razBmenp4cDZ7d3h+cnJ6JGQQXFkSWV4WWlMbVw==', 'QXNnI31qcyd7fHhuLHRhejBmc31gNWJ4OHZsfm5qbHZURAJYFFgZ', 'VGlrcCRxaWhkKWN4LH56Znx9Mnp6NXJybnx2dGxwe3FUDwJqUAJVB1hbRUlNT0JWEFNHVFNMOz1ZV14bUVxHHyMuMDExNTJnMSY/OWw+Lzk1InxzEDo4cCx5NS05LyktCRUHQwULH2piDBICHxkHARdRARICEBEWFRwJWwkTEhrz8qL66/Cm5vrsqu3p6OLm/vay5fHn77f66/vt+bM='
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u003773d1bc997c9bb3/f7bb7d1ffd73c73.cs Base64 encoded string: 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg=='
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u0037171791c1b9f1c3/u00319d7f73f91fb1fd.cs Base64 encoded string: 'VW9ne3RgZXNtbSpleWBsamIxfXU0YXl8fXdpO3VzPn5OAUtNSExIQghHRU9JDUpKVlhcWkBcWVkYVlQbUFRQWmA=', 'VW9ne3RgZXNtbSpuYmkuYHYxe314fHhyOHd1f3k9enpGSExKUExJSQhGRAtAREBKEA=='
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, fdc1131dcd7fbdc/u003197b393f33dfdbf.cs Base64 encoded string: 'UEBRYnJgQ2NhfWV5LHY+chpzazNZdGJhfXA6SGh4eH5STlQpQkpUB3hbQ1hDQw5uQlJaWkBQVUMYQgtGNjdWSzQxMXlraiEuPCE/KWIuISJ/NyAyMzgzJXcJGwg9KzsaBAgWDBY='
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, dbd9bcf91cfcc9f/bb9c3b7ddd9c31d.cs Base64 encoded string: 'SHV2c0hsdXNtZ295LCNASkQxJj0hOTZacXpodG9yeGsOblVKSgtuSFtdBGNYWV5jWUJGVlpQRBcKFwoVDBMO', 'Tm4iVGFnVWhrYm9/LH57f2B+YGc0cXNjfXpufngxPkhJT0ZMU1YGHwhGWAtATFpKQhFbQBRHU0ZNUEheWBM='
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u0037171791c1b9f1c3/u00391fd97c133371c3.cs Base64 encoded string: 'QW1uI381eyd4e2N4Y2NrfWMxYXB8cHJidHx+O3pybD9SRE5GRVZDCQ==', 'QW8iZnZ3aXUoZmloeX9razBmenp4cDZ7d3h+cnJ6JGQQXFkSWV4WWlMbVw==', 'QXNnI31qcyd7fHhuLHRhejBmc31gNWJ4OHZsfm5qbHZURAJYFFgZ', 'VGlrcCRxaWhkKWN4LH56Znx9Mnp6NXJybnx2dGxwe3FUDwJqUAJVB1hbRUlNT0JWEFNHVFNMOz1ZV14bUVxHHyMuMDExNTJnMSY/OWw+Lzk1InxzEDo4cCx5NS05LyktCRUHQwULH2piDBICHxkHARdRARICEBEWFRwJWwkTEhrz8qL66/Cm5vrsqu3p6OLm/vay5fHn77f66/vt+bM='
Source: 0.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u0037171791c1b9f1c3/u00391fd97c133371c3.cs Base64 encoded string: 'QW1uI381eyd4e2N4Y2NrfWMxYXB8cHJidHx+O3pybD9SRE5GRVZDCQ==', 'QW8iZnZ3aXUoZmloeX9razBmenp4cDZ7d3h+cnJ6JGQQXFkSWV4WWlMbVw==', 'QXNnI31qcyd7fHhuLHRhejBmc31gNWJ4OHZsfm5qbHZURAJYFFgZ', 'VGlrcCRxaWhkKWN4LH56Znx9Mnp6NXJybnx2dGxwe3FUDwJqUAJVB1hbRUlNT0JWEFNHVFNMOz1ZV14bUVxHHyMuMDExNTJnMSY/OWw+Lzk1InxzEDo4cCx5NS05LyktCRUHQwULH2piDBICHxkHARdRARICEBEWFRwJWwkTEhrz8qL66/Cm5vrsqu3p6OLm/vay5fHn77f66/vt+bM='
Source: 0.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u003773d1bc997c9bb3/f7bb7d1ffd73c73.cs Base64 encoded string: 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg=='
Source: 0.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, dbd9bcf91cfcc9f/bb9c3b7ddd9c31d.cs Base64 encoded string: 'SHV2c0hsdXNtZ295LCNASkQxJj0hOTZacXpodG9yeGsOblVKSgtuSFtdBGNYWV5jWUJGVlpQRBcKFwoVDBMO', 'Tm4iVGFnVWhrYm9/LH57f2B+YGc0cXNjfXpufngxPkhJT0ZMU1YGHwhGWAtATFpKQhFbQBRHU0ZNUEheWBM='
Source: 0.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, fdc1131dcd7fbdc/u003197b393f33dfdbf.cs Base64 encoded string: 'UEBRYnJgQ2NhfWV5LHY+chpzazNZdGJhfXA6SGh4eH5STlQpQkpUB3hbQ1hDQw5uQlJaWkBQVUMYQgtGNjdWSzQxMXlraiEuPCE/KWIuISJ/NyAyMzgzJXcJGwg9KzsaBAgWDBY='
Source: 0.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u0037171791c1b9f1c3/u00319d7f73f91fb1fd.cs Base64 encoded string: 'VW9ne3RgZXNtbSpleWBsamIxfXU0YXl8fXdpO3VzPn5OAUtNSExIQghHRU9JDUpKVlhcWkBcWVkYVlQbUFRQWmA=', 'VW9ne3RgZXNtbSpuYmkuYHYxe314fHhyOHd1f3k9enpGSExKUExJSQhGRAtAREBKEA=='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.1.unpack, u003773d1bc997c9bb3/f7bb7d1ffd73c73.cs Base64 encoded string: 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg=='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.1.unpack, fdc1131dcd7fbdc/u003197b393f33dfdbf.cs Base64 encoded string: 'UEBRYnJgQ2NhfWV5LHY+chpzazNZdGJhfXA6SGh4eH5STlQpQkpUB3hbQ1hDQw5uQlJaWkBQVUMYQgtGNjdWSzQxMXlraiEuPCE/KWIuISJ/NyAyMzgzJXcJGwg9KzsaBAgWDBY='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.1.unpack, u0037171791c1b9f1c3/u00319d7f73f91fb1fd.cs Base64 encoded string: 'VW9ne3RgZXNtbSpleWBsamIxfXU0YXl8fXdpO3VzPn5OAUtNSExIQghHRU9JDUpKVlhcWkBcWVkYVlQbUFRQWmA=', 'VW9ne3RgZXNtbSpuYmkuYHYxe314fHhyOHd1f3k9enpGSExKUExJSQhGRAtAREBKEA=='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.1.unpack, dbd9bcf91cfcc9f/bb9c3b7ddd9c31d.cs Base64 encoded string: 'SHV2c0hsdXNtZ295LCNASkQxJj0hOTZacXpodG9yeGsOblVKSgtuSFtdBGNYWV5jWUJGVlpQRBcKFwoVDBMO', 'Tm4iVGFnVWhrYm9/LH57f2B+YGc0cXNjfXpufngxPkhJT0ZMU1YGHwhGWAtATFpKQhFbQBRHU0ZNUEheWBM='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.1.unpack, u0037171791c1b9f1c3/u00391fd97c133371c3.cs Base64 encoded string: 'QW1uI381eyd4e2N4Y2NrfWMxYXB8cHJidHx+O3pybD9SRE5GRVZDCQ==', 'QW8iZnZ3aXUoZmloeX9razBmenp4cDZ7d3h+cnJ6JGQQXFkSWV4WWlMbVw==', 'QXNnI31qcyd7fHhuLHRhejBmc31gNWJ4OHZsfm5qbHZURAJYFFgZ', 'VGlrcCRxaWhkKWN4LH56Znx9Mnp6NXJybnx2dGxwe3FUDwJqUAJVB1hbRUlNT0JWEFNHVFNMOz1ZV14bUVxHHyMuMDExNTJnMSY/OWw+Lzk1InxzEDo4cCx5NS05LyktCRUHQwULH2piDBICHxkHARdRARICEBEWFRwJWwkTEhrz8qL66/Cm5vrsqu3p6OLm/vay5fHn77f66/vt+bM='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.3.unpack, u003773d1bc997c9bb3/f7bb7d1ffd73c73.cs Base64 encoded string: 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg=='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.3.unpack, u0037171791c1b9f1c3/u00319d7f73f91fb1fd.cs Base64 encoded string: 'VW9ne3RgZXNtbSpleWBsamIxfXU0YXl8fXdpO3VzPn5OAUtNSExIQghHRU9JDUpKVlhcWkBcWVkYVlQbUFRQWmA=', 'VW9ne3RgZXNtbSpuYmkuYHYxe314fHhyOHd1f3k9enpGSExKUExJSQhGRAtAREBKEA=='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.3.unpack, dbd9bcf91cfcc9f/bb9c3b7ddd9c31d.cs Base64 encoded string: 'SHV2c0hsdXNtZ295LCNASkQxJj0hOTZacXpodG9yeGsOblVKSgtuSFtdBGNYWV5jWUJGVlpQRBcKFwoVDBMO', 'Tm4iVGFnVWhrYm9/LH57f2B+YGc0cXNjfXpufngxPkhJT0ZMU1YGHwhGWAtATFpKQhFbQBRHU0ZNUEheWBM='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.3.unpack, fdc1131dcd7fbdc/u003197b393f33dfdbf.cs Base64 encoded string: 'UEBRYnJgQ2NhfWV5LHY+chpzazNZdGJhfXA6SGh4eH5STlQpQkpUB3hbQ1hDQw5uQlJaWkBQVUMYQgtGNjdWSzQxMXlraiEuPCE/KWIuISJ/NyAyMzgzJXcJGwg9KzsaBAgWDBY='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.3.unpack, u0037171791c1b9f1c3/u00391fd97c133371c3.cs Base64 encoded string: 'QW1uI381eyd4e2N4Y2NrfWMxYXB8cHJidHx+O3pybD9SRE5GRVZDCQ==', 'QW8iZnZ3aXUoZmloeX9razBmenp4cDZ7d3h+cnJ6JGQQXFkSWV4WWlMbVw==', 'QXNnI31qcyd7fHhuLHRhejBmc31gNWJ4OHZsfm5qbHZURAJYFFgZ', 'VGlrcCRxaWhkKWN4LH56Znx9Mnp6NXJybnx2dGxwe3FUDwJqUAJVB1hbRUlNT0JWEFNHVFNMOz1ZV14bUVxHHyMuMDExNTJnMSY/OWw+Lzk1InxzEDo4cCx5NS05LyktCRUHQwULH2piDBICHxkHARdRARICEBEWFRwJWwkTEhrz8qL66/Cm5vrsqu3p6OLm/vay5fHn77f66/vt+bM='
Source: 10.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u0037171791c1b9f1c3/u00391fd97c133371c3.cs Base64 encoded string: 'QW1uI381eyd4e2N4Y2NrfWMxYXB8cHJidHx+O3pybD9SRE5GRVZDCQ==', 'QW8iZnZ3aXUoZmloeX9razBmenp4cDZ7d3h+cnJ6JGQQXFkSWV4WWlMbVw==', 'QXNnI31qcyd7fHhuLHRhejBmc31gNWJ4OHZsfm5qbHZURAJYFFgZ', 'VGlrcCRxaWhkKWN4LH56Znx9Mnp6NXJybnx2dGxwe3FUDwJqUAJVB1hbRUlNT0JWEFNHVFNMOz1ZV14bUVxHHyMuMDExNTJnMSY/OWw+Lzk1InxzEDo4cCx5NS05LyktCRUHQwULH2piDBICHxkHARdRARICEBEWFRwJWwkTEhrz8qL66/Cm5vrsqu3p6OLm/vay5fHn77f66/vt+bM='
Source: 10.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u003773d1bc997c9bb3/f7bb7d1ffd73c73.cs Base64 encoded string: 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg=='
Source: 10.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, dbd9bcf91cfcc9f/bb9c3b7ddd9c31d.cs Base64 encoded string: 'SHV2c0hsdXNtZ295LCNASkQxJj0hOTZacXpodG9yeGsOblVKSgtuSFtdBGNYWV5jWUJGVlpQRBcKFwoVDBMO', 'Tm4iVGFnVWhrYm9/LH57f2B+YGc0cXNjfXpufngxPkhJT0ZMU1YGHwhGWAtATFpKQhFbQBRHU0ZNUEheWBM='
Source: 10.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, fdc1131dcd7fbdc/u003197b393f33dfdbf.cs Base64 encoded string: 'UEBRYnJgQ2NhfWV5LHY+chpzazNZdGJhfXA6SGh4eH5STlQpQkpUB3hbQ1hDQw5uQlJaWkBQVUMYQgtGNjdWSzQxMXlraiEuPCE/KWIuISJ/NyAyMzgzJXcJGwg9KzsaBAgWDBY='
Source: 10.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u0037171791c1b9f1c3/u00319d7f73f91fb1fd.cs Base64 encoded string: 'VW9ne3RgZXNtbSpleWBsamIxfXU0YXl8fXdpO3VzPn5OAUtNSExIQghHRU9JDUpKVlhcWkBcWVkYVlQbUFRQWmA=', 'VW9ne3RgZXNtbSpuYmkuYHYxe314fHhyOHd1f3k9enpGSExKUExJSQhGRAtAREBKEA=='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.2.unpack, u0037171791c1b9f1c3/u00391fd97c133371c3.cs Base64 encoded string: 'QW1uI381eyd4e2N4Y2NrfWMxYXB8cHJidHx+O3pybD9SRE5GRVZDCQ==', 'QW8iZnZ3aXUoZmloeX9razBmenp4cDZ7d3h+cnJ6JGQQXFkSWV4WWlMbVw==', 'QXNnI31qcyd7fHhuLHRhejBmc31gNWJ4OHZsfm5qbHZURAJYFFgZ', 'VGlrcCRxaWhkKWN4LH56Znx9Mnp6NXJybnx2dGxwe3FUDwJqUAJVB1hbRUlNT0JWEFNHVFNMOz1ZV14bUVxHHyMuMDExNTJnMSY/OWw+Lzk1InxzEDo4cCx5NS05LyktCRUHQwULH2piDBICHxkHARdRARICEBEWFRwJWwkTEhrz8qL66/Cm5vrsqu3p6OLm/vay5fHn77f66/vt+bM='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.2.unpack, u003773d1bc997c9bb3/f7bb7d1ffd73c73.cs Base64 encoded string: 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg=='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.2.unpack, dbd9bcf91cfcc9f/bb9c3b7ddd9c31d.cs Base64 encoded string: 'SHV2c0hsdXNtZ295LCNASkQxJj0hOTZacXpodG9yeGsOblVKSgtuSFtdBGNYWV5jWUJGVlpQRBcKFwoVDBMO', 'Tm4iVGFnVWhrYm9/LH57f2B+YGc0cXNjfXpufngxPkhJT0ZMU1YGHwhGWAtATFpKQhFbQBRHU0ZNUEheWBM='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.2.unpack, u0037171791c1b9f1c3/u00319d7f73f91fb1fd.cs Base64 encoded string: 'VW9ne3RgZXNtbSpleWBsamIxfXU0YXl8fXdpO3VzPn5OAUtNSExIQghHRU9JDUpKVlhcWkBcWVkYVlQbUFRQWmA=', 'VW9ne3RgZXNtbSpuYmkuYHYxe314fHhyOHd1f3k9enpGSExKUExJSQhGRAtAREBKEA=='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.2.unpack, fdc1131dcd7fbdc/u003197b393f33dfdbf.cs Base64 encoded string: 'UEBRYnJgQ2NhfWV5LHY+chpzazNZdGJhfXA6SGh4eH5STlQpQkpUB3hbQ1hDQw5uQlJaWkBQVUMYQgtGNjdWSzQxMXlraiEuPCE/KWIuISJ/NyAyMzgzJXcJGwg9KzsaBAgWDBY='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u0037171791c1b9f1c3/u00391fd97c133371c3.cs Base64 encoded string: 'QW1uI381eyd4e2N4Y2NrfWMxYXB8cHJidHx+O3pybD9SRE5GRVZDCQ==', 'QW8iZnZ3aXUoZmloeX9razBmenp4cDZ7d3h+cnJ6JGQQXFkSWV4WWlMbVw==', 'QXNnI31qcyd7fHhuLHRhejBmc31gNWJ4OHZsfm5qbHZURAJYFFgZ', 'VGlrcCRxaWhkKWN4LH56Znx9Mnp6NXJybnx2dGxwe3FUDwJqUAJVB1hbRUlNT0JWEFNHVFNMOz1ZV14bUVxHHyMuMDExNTJnMSY/OWw+Lzk1InxzEDo4cCx5NS05LyktCRUHQwULH2piDBICHxkHARdRARICEBEWFRwJWwkTEhrz8qL66/Cm5vrsqu3p6OLm/vay5fHn77f66/vt+bM='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u003773d1bc997c9bb3/f7bb7d1ffd73c73.cs Base64 encoded string: 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg=='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, fdc1131dcd7fbdc/u003197b393f33dfdbf.cs Base64 encoded string: 'UEBRYnJgQ2NhfWV5LHY+chpzazNZdGJhfXA6SGh4eH5STlQpQkpUB3hbQ1hDQw5uQlJaWkBQVUMYQgtGNjdWSzQxMXlraiEuPCE/KWIuISJ/NyAyMzgzJXcJGwg9KzsaBAgWDBY='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u0037171791c1b9f1c3/u00319d7f73f91fb1fd.cs Base64 encoded string: 'VW9ne3RgZXNtbSpleWBsamIxfXU0YXl8fXdpO3VzPn5OAUtNSExIQghHRU9JDUpKVlhcWkBcWVkYVlQbUFRQWmA=', 'VW9ne3RgZXNtbSpuYmkuYHYxe314fHhyOHd1f3k9enpGSExKUExJSQhGRAtAREBKEA=='
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, dbd9bcf91cfcc9f/bb9c3b7ddd9c31d.cs Base64 encoded string: 'SHV2c0hsdXNtZ295LCNASkQxJj0hOTZacXpodG9yeGsOblVKSgtuSFtdBGNYWV5jWUJGVlpQRBcKFwoVDBMO', 'Tm4iVGFnVWhrYm9/LH57f2B+YGc0cXNjfXpufngxPkhJT0ZMU1YGHwhGWAtATFpKQhFbQBRHU0ZNUEheWBM='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.13.unpack, u003773d1bc997c9bb3/f7bb7d1ffd73c73.cs Base64 encoded string: 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg=='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.13.unpack, u0037171791c1b9f1c3/u00391fd97c133371c3.cs Base64 encoded string: 'QW1uI381eyd4e2N4Y2NrfWMxYXB8cHJidHx+O3pybD9SRE5GRVZDCQ==', 'QW8iZnZ3aXUoZmloeX9razBmenp4cDZ7d3h+cnJ6JGQQXFkSWV4WWlMbVw==', 'QXNnI31qcyd7fHhuLHRhejBmc31gNWJ4OHZsfm5qbHZURAJYFFgZ', 'VGlrcCRxaWhkKWN4LH56Znx9Mnp6NXJybnx2dGxwe3FUDwJqUAJVB1hbRUlNT0JWEFNHVFNMOz1ZV14bUVxHHyMuMDExNTJnMSY/OWw+Lzk1InxzEDo4cCx5NS05LyktCRUHQwULH2piDBICHxkHARdRARICEBEWFRwJWwkTEhrz8qL66/Cm5vrsqu3p6OLm/vay5fHn77f66/vt+bM='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.13.unpack, fdc1131dcd7fbdc/u003197b393f33dfdbf.cs Base64 encoded string: 'UEBRYnJgQ2NhfWV5LHY+chpzazNZdGJhfXA6SGh4eH5STlQpQkpUB3hbQ1hDQw5uQlJaWkBQVUMYQgtGNjdWSzQxMXlraiEuPCE/KWIuISJ/NyAyMzgzJXcJGwg9KzsaBAgWDBY='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.13.unpack, dbd9bcf91cfcc9f/bb9c3b7ddd9c31d.cs Base64 encoded string: 'SHV2c0hsdXNtZ295LCNASkQxJj0hOTZacXpodG9yeGsOblVKSgtuSFtdBGNYWV5jWUJGVlpQRBcKFwoVDBMO', 'Tm4iVGFnVWhrYm9/LH57f2B+YGc0cXNjfXpufngxPkhJT0ZMU1YGHwhGWAtATFpKQhFbQBRHU0ZNUEheWBM='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.13.unpack, u0037171791c1b9f1c3/u00319d7f73f91fb1fd.cs Base64 encoded string: 'VW9ne3RgZXNtbSpleWBsamIxfXU0YXl8fXdpO3VzPn5OAUtNSExIQghHRU9JDUpKVlhcWkBcWVkYVlQbUFRQWmA=', 'VW9ne3RgZXNtbSpuYmkuYHYxe314fHhyOHd1f3k9enpGSExKUExJSQhGRAtAREBKEA=='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.7.unpack, u0037171791c1b9f1c3/u00391fd97c133371c3.cs Base64 encoded string: 'QW1uI381eyd4e2N4Y2NrfWMxYXB8cHJidHx+O3pybD9SRE5GRVZDCQ==', 'QW8iZnZ3aXUoZmloeX9razBmenp4cDZ7d3h+cnJ6JGQQXFkSWV4WWlMbVw==', 'QXNnI31qcyd7fHhuLHRhejBmc31gNWJ4OHZsfm5qbHZURAJYFFgZ', 'VGlrcCRxaWhkKWN4LH56Znx9Mnp6NXJybnx2dGxwe3FUDwJqUAJVB1hbRUlNT0JWEFNHVFNMOz1ZV14bUVxHHyMuMDExNTJnMSY/OWw+Lzk1InxzEDo4cCx5NS05LyktCRUHQwULH2piDBICHxkHARdRARICEBEWFRwJWwkTEhrz8qL66/Cm5vrsqu3p6OLm/vay5fHn77f66/vt+bM='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.7.unpack, u003773d1bc997c9bb3/f7bb7d1ffd73c73.cs Base64 encoded string: 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg=='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.7.unpack, u0037171791c1b9f1c3/u00319d7f73f91fb1fd.cs Base64 encoded string: 'VW9ne3RgZXNtbSpleWBsamIxfXU0YXl8fXdpO3VzPn5OAUtNSExIQghHRU9JDUpKVlhcWkBcWVkYVlQbUFRQWmA=', 'VW9ne3RgZXNtbSpuYmkuYHYxe314fHhyOHd1f3k9enpGSExKUExJSQhGRAtAREBKEA=='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.7.unpack, fdc1131dcd7fbdc/u003197b393f33dfdbf.cs Base64 encoded string: 'UEBRYnJgQ2NhfWV5LHY+chpzazNZdGJhfXA6SGh4eH5STlQpQkpUB3hbQ1hDQw5uQlJaWkBQVUMYQgtGNjdWSzQxMXlraiEuPCE/KWIuISJ/NyAyMzgzJXcJGwg9KzsaBAgWDBY='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.7.unpack, dbd9bcf91cfcc9f/bb9c3b7ddd9c31d.cs Base64 encoded string: 'SHV2c0hsdXNtZ295LCNASkQxJj0hOTZacXpodG9yeGsOblVKSgtuSFtdBGNYWV5jWUJGVlpQRBcKFwoVDBMO', 'Tm4iVGFnVWhrYm9/LH57f2B+YGc0cXNjfXpufngxPkhJT0ZMU1YGHwhGWAtATFpKQhFbQBRHU0ZNUEheWBM='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.11.unpack, u0037171791c1b9f1c3/u00391fd97c133371c3.cs Base64 encoded string: 'QW1uI381eyd4e2N4Y2NrfWMxYXB8cHJidHx+O3pybD9SRE5GRVZDCQ==', 'QW8iZnZ3aXUoZmloeX9razBmenp4cDZ7d3h+cnJ6JGQQXFkSWV4WWlMbVw==', 'QXNnI31qcyd7fHhuLHRhejBmc31gNWJ4OHZsfm5qbHZURAJYFFgZ', 'VGlrcCRxaWhkKWN4LH56Znx9Mnp6NXJybnx2dGxwe3FUDwJqUAJVB1hbRUlNT0JWEFNHVFNMOz1ZV14bUVxHHyMuMDExNTJnMSY/OWw+Lzk1InxzEDo4cCx5NS05LyktCRUHQwULH2piDBICHxkHARdRARICEBEWFRwJWwkTEhrz8qL66/Cm5vrsqu3p6OLm/vay5fHn77f66/vt+bM='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.11.unpack, u003773d1bc997c9bb3/f7bb7d1ffd73c73.cs Base64 encoded string: 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg==', 'TWhhcWt2aWF8J0V8ZWMgR39iZj1cYWJnVHBpb3lze20OblVKSm1SU1hlQ1hYSEBKQg=='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.11.unpack, u0037171791c1b9f1c3/u00319d7f73f91fb1fd.cs Base64 encoded string: 'VW9ne3RgZXNtbSpleWBsamIxfXU0YXl8fXdpO3VzPn5OAUtNSExIQghHRU9JDUpKVlhcWkBcWVkYVlQbUFRQWmA=', 'VW9ne3RgZXNtbSpuYmkuYHYxe314fHhyOHd1f3k9enpGSExKUExJSQhGRAtAREBKEA=='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.11.unpack, dbd9bcf91cfcc9f/bb9c3b7ddd9c31d.cs Base64 encoded string: 'SHV2c0hsdXNtZ295LCNASkQxJj0hOTZacXpodG9yeGsOblVKSgtuSFtdBGNYWV5jWUJGVlpQRBcKFwoVDBMO', 'Tm4iVGFnVWhrYm9/LH57f2B+YGc0cXNjfXpufngxPkhJT0ZMU1YGHwhGWAtATFpKQhFbQBRHU0ZNUEheWBM='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.11.unpack, fdc1131dcd7fbdc/u003197b393f33dfdbf.cs Base64 encoded string: 'UEBRYnJgQ2NhfWV5LHY+chpzazNZdGJhfXA6SGh4eH5STlQpQkpUB3hbQ1hDQw5uQlJaWkBQVUMYQgtGNjdWSzQxMXlraiEuPCE/KWIuISJ/NyAyMzgzJXcJGwg9KzsaBAgWDBY='
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6740:120:WilError_01
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{20fcb0e8-3b1f-4bdb-88e7-54967ec4f249}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6884:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6680:120:WilError_01
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe File created: C:\Program Files\Common Files\System\9f3df393cbbd19b Jump to behavior
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe String found in binary or memory: VMS2n+KMtE+ZE8oTPcOD6Bx1/AdDWHjMN0gvVCVA4nKR1+XOaE7q804pOM1n/p/NXLTv7x2XRj3Dr8iFrgHBG+DffTCRRu9FwNn4bgD1YneGeLSq2vj87IBA9xPP8dWL68w6gCZbzyqdxJmej8R+ABdJNI3GxzA5LPNwHdaPWsTrPHmv6Bg/kHkTbDgeIOs9Pb3nhkehOpciPA6fAO32WzTt9q4AODPMBSC9qKy2AWIn+P3KRwqtZ5K46FWofW7f4L2v
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe String found in binary or memory: toLEnKWw9p8iPQT3QekY8fg9dnUSh6oDbYUW1fnwHJ9TPh40ea4bqOgOjZoDVcyMCGmCYb5HhwaXsGUWrs5pzl9sg4ewATICA6GeN4ijKFdxq4x2F9P3+bqbi1AkkDteZJV0Nf19Q+ppm4wVo8otfq/cIJLNav95ej7Ov8A0v6wmas/ooSLg7nneC82sfJYf0CWOrcAChQOd/Jmum/eSyo+Kmg/4UTr7PHqN8RJ/ncMoLAG1rQOUGG70rp1KI/AddnsU
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe String found in binary or memory: VMS2n+KMtE+ZE8oTPcOD6Bx1/AdDWHjMN0gvVCVA4nKR1+XOaE7q804pOM1n/p/NXLTv7x2XRj3Dr8iFrgHBG+DffTCRRu9FwNn4bgD1YneGeLSq2vj87IBA9xPP8dWL68w6gCZbzyqdxJmej8R+ABdJNI3GxzA5LPNwHdaPWsTrPHmv6Bg/kHkTbDgeIOs9Pb3nhkehOpciPA6fAO32WzTt9q4AODPMBSC9qKy2AWIn+P3KRwqtZ5K46FWofW7f4L2v
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe String found in binary or memory: toLEnKWw9p8iPQT3QekY8fg9dnUSh6oDbYUW1fnwHJ9TPh40ea4bqOgOjZoDVcyMCGmCYb5HhwaXsGUWrs5pzl9sg4ewATICA6GeN4ijKFdxq4x2F9P3+bqbi1AkkDteZJV0Nf19Q+ppm4wVo8otfq/cIJLNav95ej7Ov8A0v6wmas/ooSLg7nneC82sfJYf0CWOrcAChQOd/Jmum/eSyo+Kmg/4UTr7PHqN8RJ/ncMoLAG1rQOUGG70rp1KI/AddnsU
Source: svchost.exe String found in binary or memory: VMS2n+KMtE+ZE8oTPcOD6Bx1/AdDWHjMN0gvVCVA4nKR1+XOaE7q804pOM1n/p/NXLTv7x2XRj3Dr8iFrgHBG+DffTCRRu9FwNn4bgD1YneGeLSq2vj87IBA9xPP8dWL68w6gCZbzyqdxJmej8R+ABdJNI3GxzA5LPNwHdaPWsTrPHmv6Bg/kHkTbDgeIOs9Pb3nhkehOpciPA6fAO32WzTt9q4AODPMBSC9qKy2AWIn+P3KRwqtZ5K46FWofW7f4L2v
Source: svchost.exe String found in binary or memory: toLEnKWw9p8iPQT3QekY8fg9dnUSh6oDbYUW1fnwHJ9TPh40ea4bqOgOjZoDVcyMCGmCYb5HhwaXsGUWrs5pzl9sg4ewATICA6GeN4ijKFdxq4x2F9P3+bqbi1AkkDteZJV0Nf19Q+ppm4wVo8otfq/cIJLNav95ej7Ov8A0v6wmas/ooSLg7nneC82sfJYf0CWOrcAChQOd/Jmum/eSyo+Kmg/4UTr7PHqN8RJ/ncMoLAG1rQOUGG70rp1KI/AddnsU
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'CreateDecryptor'
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs Cryptographic APIs: 'TransformFinalBlock'
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Static file information: File size 1094656 > 1048576
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Directory created: C:\Program Files\Common Files\System\9f3df393cbbd19b Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Directory created: C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe Jump to behavior
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: c:\BuildAgent\work\485425247c27f279\RuntimeRelease\src\Microsoft.Owin.Host.HttpListener\obj\net45\Release\Microsoft.Owin.Host.HttpListener.pdb source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000A.00000000.283112397.0000000000C32000.00000020.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000000.288765429.0000000000C32000.00000020.00000001.01000000.00000003.sdmp, svchost.exe, svchost.exe, 00000013.00000002.414384522.0000000006C01000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.407528088.0000000004B66000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.407028015.000000000417A000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.397600705.0000000000A22000.00000020.00000001.01000000.00000006.sdmp, svchost.exe, 00000013.00000000.301566372.0000000000A22000.00000020.00000001.01000000.00000006.sdmp, svchost.exe, 00000014.00000002.413516155.0000000000A22000.00000020.00000001.01000000.00000006.sdmp, svchost.exe, 00000014.00000000.318432134.0000000000A22000.00000020.00000001.01000000.00000006.sdmp, svchost.exe, 00000014.00000002.454271439.0000000006741000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.439228512.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: er.pdb source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.519619122.00000000013A5000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs .Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs .Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_05157DA0 push ecx; ret 19_2_05157DB5
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 19_2_057E7019 push eax; mov dword ptr [esp], edx 19_2_057E7029
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE1589 push eax; retf 20_2_04CE158A
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE7761 push ecx; ret 20_2_04CE7775
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE6091 pushfd ; retf 20_2_04CE6092
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE3139 pushad ; retf 20_2_04CE313A
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CEC302 push E80B905Eh; ret 20_2_04CEC309
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE1C03 push esi; retf 20_2_04CE1C0A
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE1C00 push edi; retf 20_2_04CE1C02
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE18C8 push ecx; retf 20_2_04CE18D2
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE19F3 push edx; retf 20_2_04CE19FA
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE19AB push edx; retf 20_2_04CE19AA
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE19A3 push edx; retf 20_2_04CE19AA
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE19A1 push edx; retf 20_2_04CE19A2
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE195B push ecx; retf 20_2_04CE1972
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE1953 push ecx; retf 20_2_04CE195A
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE1951 push ecx; retf 20_2_04CE1952
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE1973 push ecx; retf 20_2_04CE197A
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE1A97 push edx; retf 20_2_04CE1A9A
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE1A93 push edx; retf 20_2_04CE1A96
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE1A5B push edx; retf 20_2_04CE1A72
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE1A53 push edx; retf 20_2_04CE1A5A
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_04CE1A00 push edx; retf 20_2_04CE1A52
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_08A26AAA push eax; retf 20_2_08A26AB1
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_08A2DD80 push ds; retf 20_2_08A2DD82
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_08A2DDC9 push ds; retf 20_2_08A2DDCA
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Code function: 20_2_08A2DD1B push ds; retf 20_2_08A2DD22
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Persistence and Installation Behavior
barindex
Drops PE files with benign system names
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe File created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Jump to dropped file
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe File created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Jump to dropped file

Boot Survival
barindex
Creates autostart registry keys with suspicious names
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce b1bbd3cd1f3dc3f Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run b1bbd3cd1f3dc3f Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run b1bbd3cd1f3dc3f Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce b1bbd3cd1f3dc3f Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce b1bbd3cd1f3dc3f Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce b1bbd3cd1f3dc3f Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce b1bbd3cd1f3dc3f Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Contains functionality to hide user accounts
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.315747535.00000000042C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.315747535.00000000042C6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: localgroup administrators aREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: svchost.exe, 00000013.00000002.407528088.0000000004B66000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: svchost.exe, 00000013.00000002.407528088.0000000004B66000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: localgroup administrators aREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Source: svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: localgroup administrators aREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe File opened: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe:Zone.Identifier read attributes | delete
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 00000017.00000002.455661401.0000000004826000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.437946042.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.315747535.00000000042C6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.398758851.0000000003121000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.407528088.0000000004B66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002A.00000002.492650397.00000000051B6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.416839988.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.455177342.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.474526157.0000000004926000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 6272, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 2988, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 1472, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.315747535.00000000042C6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.309880319.0000000002881000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.407528088.0000000004B66000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.398758851.0000000003121000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.416839988.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.315747535.00000000042C6000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.309880319.0000000002881000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.407528088.0000000004B66000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.398758851.0000000003121000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.416839988.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe TID: 6300 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6936 Thread sleep time: -15679732462653109s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6828 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6988 Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6896 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6992 Thread sleep count: 6637 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7080 Thread sleep time: -12912720851596678s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6996 Thread sleep count: 1209 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7016 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe TID: 6612 Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe TID: 6536 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe TID: 4000 Thread sleep time: -922337203685477s >= -30000s
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1515 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1447
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6637 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1209 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Window / User API: threadDelayed 6739
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Window / User API: threadDelayed 2580
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Window / User API: foregroundWindowGot 433
Contains capabilities to detect virtual machines
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe File opened / queried: C:\WINDOWS\SysWOW64\drivers\vmmouse.sys
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe File opened / queried: C:\WINDOWS\SysWOW64\drivers\vmhgfs.sys
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe File opened / queried: C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Thread delayed: delay time: 922337203685477
Source: svchost.exe, 00000014.00000002.416105811.0000000000EAF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware
Source: svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\EnumNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: svchost.exe, 00000014.00000002.416105811.0000000000EAF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Win32_VideoController(Standard display types)VMware4VCP6NY1Win32_VideoController1GK5OS88VideoController120060621000000.000000-00099521527display.infMSBDA5VNDBO56PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors2E8PC1WX
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.315747535.00000000042C6000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.407528088.0000000004B66000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: WWW /c Microsoft-Hyper-V-Common-Drivers-Package
Source: svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: svchost.exe Binary or memory string: qdEUsFWs4TvMcIqfOt+qY8r8HH2ht4K8OpT0/TXHChXrUWnvFm9nckq71ChfoJ3X9B9WyzbQkI/vm11We6Lf2gRxeTCkwViVTr3KogFw21uH4jL6qewnnRzQMSDJx9LatD/Lkk7JzR9I4b1YSkuhysDRmERQFDTTopNhvJd5BAC56bBuRKyT75oOi8rMlmL+RjynnzrwOIeutMIs4YNfcND6gkn8lvp0Z5Zzo/92hroTAnvC8n+3/RQwHkAfsgPHXgDE
Source: svchost.exe, 00000014.00000002.416839988.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE
Source: svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: svchost.exe, 00000014.00000002.416839988.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: l&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000003.259030936.0000000000A14000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Y\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools
Source: svchost.exe, 00000013.00000002.398758851.0000000003121000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmwareIn
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, svchost.exe Binary or memory string: nlaVHLtWfd52xSOYbEkOQhAt170+KnM3xBKp5+bBO/oKoMiDD572dWSJvK82mSKUxJlIfSZbYQv3W8mVJZjkGAGIH7b5TVSW2NeeRa6T+xQo6W4dJFL6m54S2Pu9yJ3N8H4IJLxcMbrUNevrtVHVahnqlCZ07brSZZjEwlaeSpQjrYYikUjXiZEAFCsw3gvgfHrhklLkal2EkhgF/wQemUr+KA3v10TabE6f7V2t38M+jyPGJujB7L+XHM9z/JvVS3M3
Source: svchost.exe, 00000014.00000002.416839988.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.519961531.000000000144E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.517009972.0000013A10E28000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.517606669.00000200E0268000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.516729689.0000015522029000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe Binary or memory string: 5DakqMO9hvuLkuCzVPybDXGOOJLJc41Jlq9ZmTzvU1ru6SXyMuyZKxw72EdwG8eYyKw17veSzc/XCAm8suzdoZ3MRzry1qPFpqVU2/4UYKl8gLDp6hIYErDCmEbT43m8obBh/EIisDvmciDoNFjMmev5ylhFA5Co8sbt1642WNPbHIbdtM8cTFTuOstUJY6oO0MXP5ZktE6MNdGlMEGFOWBYHWSxbPQC0K6prOaL32H26njHxuC0TpVjRk7W7DuD9QiZ
Source: svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: svchost.exe, 00000014.00000002.416839988.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: svchost.exe, 00000014.00000002.416839988.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: svchost.exe Binary or memory string: bIDZDg0HI+hhNeZmiG5IUFI+07sZ2HrotlXAnyHupMuh1NIxLh24+6Ekw1WXJsvp3do2SA9Jn/5VOXi13YQu4RXGeG6V8uKDxiZ52RCZ1zxRGwNvMCiM3TbI6k4x3OAM33rdZzU38qv+8ZIsrnWyVbfopWvOjhn4E0mrKGQsyqBwyj9DKFX/dFcHsTiLfGEAk4prjvwFa3iqhxd/tSTsB4FqwZDIBhGJRKTpevzyeBF1RKbTsv1bLmqCyBtKnNVAPiu0
Source: svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: svchost.exe Binary or memory string: 09vFYwbHQvZHK28gE7LjGxVxQvRttnXdAaVReOvaIRd8IFqpOB0CgkTD+JJ+Z6WVqtKL/ffpUfztORK+1csmOCsX8bS2sU9gTs/EmxmQAvmCIrtJegMrO52nsv19JCr3waB04N15Osf785Mdkfk3b4Mftfy3EV/z7bOxbtQ6KObR6/1lQVGTHVu2xYjt/cJsNDr+nPsQ4iiJILRoAIeznYL/OFVM4b/rkig+mGfGQAHQPuShbdnrSCzigKFlUspKq3CF
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000003.259030936.0000000000A14000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools[
Source: svchost.exe, 0000000D.00000002.516186722.0000013A10E02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: svchost.exe, 00000014.00000002.439849738.00000000046E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: svchost.exe, 00000014.00000002.416839988.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: l)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: svchost.exe, 00000014.00000002.416839988.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: l'C:\WINDOWS\system32\drivers\vmmouse.sys
Source: svchost.exe, 00000014.00000002.416839988.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools
Enables debug privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, u0037171791c1b9f1c3/u0031b997f7fc93bff9.cs Reference to suspicious API methods: ('d9c7d9f71cfbfc9', 'GetProcAddress@kernel32'), ('11b1f11cc79ccdd', 'LoadLibrary@kernel32')
Source: svchost.exe.0.dr, u0037171791c1b9f1c3/u0031b997f7fc93bff9.cs Reference to suspicious API methods: ('d9c7d9f71cfbfc9', 'GetProcAddress@kernel32'), ('11b1f11cc79ccdd', 'LoadLibrary@kernel32')
Source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u0037171791c1b9f1c3/u0031b997f7fc93bff9.cs Reference to suspicious API methods: ('d9c7d9f71cfbfc9', 'GetProcAddress@kernel32'), ('11b1f11cc79ccdd', 'LoadLibrary@kernel32')
Source: 0.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u0037171791c1b9f1c3/u0031b997f7fc93bff9.cs Reference to suspicious API methods: ('d9c7d9f71cfbfc9', 'GetProcAddress@kernel32'), ('11b1f11cc79ccdd', 'LoadLibrary@kernel32')
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.1.unpack, u0037171791c1b9f1c3/u0031b997f7fc93bff9.cs Reference to suspicious API methods: ('d9c7d9f71cfbfc9', 'GetProcAddress@kernel32'), ('11b1f11cc79ccdd', 'LoadLibrary@kernel32')
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.3.unpack, u0037171791c1b9f1c3/u0031b997f7fc93bff9.cs Reference to suspicious API methods: ('d9c7d9f71cfbfc9', 'GetProcAddress@kernel32'), ('11b1f11cc79ccdd', 'LoadLibrary@kernel32')
Source: 10.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u0037171791c1b9f1c3/u0031b997f7fc93bff9.cs Reference to suspicious API methods: ('d9c7d9f71cfbfc9', 'GetProcAddress@kernel32'), ('11b1f11cc79ccdd', 'LoadLibrary@kernel32')
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.2.unpack, u0037171791c1b9f1c3/u0031b997f7fc93bff9.cs Reference to suspicious API methods: ('d9c7d9f71cfbfc9', 'GetProcAddress@kernel32'), ('11b1f11cc79ccdd', 'LoadLibrary@kernel32')
Source: 10.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.0.unpack, u0037171791c1b9f1c3/u0031b997f7fc93bff9.cs Reference to suspicious API methods: ('d9c7d9f71cfbfc9', 'GetProcAddress@kernel32'), ('11b1f11cc79ccdd', 'LoadLibrary@kernel32')
Source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, u0023u003dqjryTBW16mUfo_ItH9KWoGQu003du003d.cs Reference to suspicious API methods: ('#=qxG$Aklpbf6gyBfAqTMmORA==', 'OpenProcess@kernel32.dll'), ('#=qh7diH14jww3Fm9rMJ_jIfQ==', 'FindResourceEx@kernel32.dll')
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.13.unpack, u0037171791c1b9f1c3/u0031b997f7fc93bff9.cs Reference to suspicious API methods: ('d9c7d9f71cfbfc9', 'GetProcAddress@kernel32'), ('11b1f11cc79ccdd', 'LoadLibrary@kernel32')
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, u0023u003dqjryTBW16mUfo_ItH9KWoGQu003du003d.cs Reference to suspicious API methods: ('#=qxG$Aklpbf6gyBfAqTMmORA==', 'OpenProcess@kernel32.dll'), ('#=qh7diH14jww3Fm9rMJ_jIfQ==', 'FindResourceEx@kernel32.dll')
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, u0023u003dqjryTBW16mUfo_ItH9KWoGQu003du003d.cs Reference to suspicious API methods: ('#=qxG$Aklpbf6gyBfAqTMmORA==', 'OpenProcess@kernel32.dll'), ('#=qh7diH14jww3Fm9rMJ_jIfQ==', 'FindResourceEx@kernel32.dll')
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.7.unpack, u0037171791c1b9f1c3/u0031b997f7fc93bff9.cs Reference to suspicious API methods: ('d9c7d9f71cfbfc9', 'GetProcAddress@kernel32'), ('11b1f11cc79ccdd', 'LoadLibrary@kernel32')
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.c30000.11.unpack, u0037171791c1b9f1c3/u0031b997f7fc93bff9.cs Reference to suspicious API methods: ('d9c7d9f71cfbfc9', 'GetProcAddress@kernel32'), ('11b1f11cc79ccdd', 'LoadLibrary@kernel32')
Source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, u0023u003dqjryTBW16mUfo_ItH9KWoGQu003du003d.cs Reference to suspicious API methods: ('#=qxG$Aklpbf6gyBfAqTMmORA==', 'OpenProcess@kernel32.dll'), ('#=qh7diH14jww3Fm9rMJ_jIfQ==', 'FindResourceEx@kernel32.dll')
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Memory written: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe base: 400000 value starts with: 4D5A
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Memory written: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe base: 400000 value starts with: 4D5A
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe" -Force
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe" -Force
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe" -Force
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe" -Force Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe" -Force Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe" -Force Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe" -Force Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe" -Force Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe" -Force Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Jump to behavior
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\hhhnf0tr.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\y5zio4ie.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\jcxc0kzm.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\axo2mpum.inf
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Process created: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe C:\Program Files\Common Files\System\9f3df393cbbd19b\svchost.exe
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.521082613.000000000310E000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.521741314.000000000345E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe VolumeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Queries volume information: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe VolumeInformation
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Queries volume information: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe VolumeInformation
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Program Files\Common Files\system\9f3df393cbbd19b\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Tedy.122593.7296.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\System32\svchost.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
AV process strings found (often used to terminate AV products)
Source: svchost.exe, 00000012.00000002.516962942.00000233A7C3D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ,@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000012.00000002.517171762.00000233A7D02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information
barindex
Yara detected Nanocore RAT
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6bfc468.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70bc468.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feb136.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6bfc468.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c1c488.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c5c4a8.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c1c488.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3ff4595.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70dc488.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70bc468.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c5c4a8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70dc488.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.711c4a8.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.711c4a8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b04629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.316156238.0000000004353000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.401214129.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.467575760.0000000006BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.470009001.0000000003E39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.521932129.0000000003FDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.409476455.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.453759641.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.431477381.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.457356006.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.435945943.0000000003EF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.388245594.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.417950863.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.480782499.0000000006E05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.436394242.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.434616704.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.397560110.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.409560894.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.430068094.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.475336457.0000000006D35000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.396951247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.412903309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002A.00000002.498775131.000000000770E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.408440713.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.290964179.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.514934188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.520502243.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.419417648.0000000007095000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002A.00000002.499618859.000000000776E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.378546866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.523441756.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.468107743.0000000006C5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.291890743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.468173514.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.316607101.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.377509658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.426838384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.293158040.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.293766876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.412427457.0000000004099000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.425602291.000000000711C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.398877683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.377041236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.411222280.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.455871572.0000000003411000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.480982915.0000000006E8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.412196132.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.469838509.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.475452157.0000000006DBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 6272, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 7096, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 2988, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 1472, type: MEMORYSTR

Remote Access Functionality
barindex
Detected Nanocore Rat
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.316156238.0000000004353000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 00000000.00000002.316607101.00000000043DA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.521932129.0000000003FDB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.521932129.0000000003FDB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000000.290964179.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.520502243.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: SecuriteInfo.com.Variant.Tedy.122593.7296.exe, 0000000B.00000002.520502243.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: svchost.exe, 00000013.00000002.425602291.000000000711C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: svchost.exe, 00000013.00000002.419417648.0000000007095000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: svchost.exe, 00000014.00000002.467575760.0000000006BD5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: svchost.exe, 00000014.00000002.468107743.0000000006C5C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Yara detected Nanocore RAT
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.0.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6bfc468.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70bc468.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feb136.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6bfc468.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c1c488.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c5c4a8.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c1c488.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.439a6a0.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3feff6c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.3ff4595.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70dc488.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70bc468.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.svchost.exe.6c5c4a8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.70dc488.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.711c4a8.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.svchost.exe.711c4a8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b04629.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.437a680.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.5b00000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Tedy.122593.7296.exe.43da6c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.316156238.0000000004353000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.401214129.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.467575760.0000000006BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.470009001.0000000003E39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.521932129.0000000003FDB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.409476455.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.453759641.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.431477381.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.457356006.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.435945943.0000000003EF9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.388245594.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.417950863.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.480782499.0000000006E05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.436394242.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.434616704.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.397560110.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.409560894.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.430068094.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.475336457.0000000006D35000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.396951247.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.412903309.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002A.00000002.498775131.000000000770E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.408440713.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.290964179.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.514934188.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.520502243.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.419417648.0000000007095000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002A.00000002.499618859.000000000776E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.378546866.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.523441756.0000000005B00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.468107743.0000000006C5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.291890743.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.468173514.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.316607101.00000000043DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.377509658.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000000.426838384.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.293158040.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000000.293766876.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.412427457.0000000004099000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.425602291.000000000711C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.398877683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.377041236.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000000.411222280.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.455871572.0000000003411000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.480982915.0000000006E8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.412196132.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.469838509.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.475452157.0000000006DBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 6272, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Variant.Tedy.122593.7296.exe PID: 7096, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 2988, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 1472, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 631411 Sample: SecuriteInfo.com.Variant.Te... Startdate: 21/05/2022 Architecture: WINDOWS Score: 100 52 127.0.0.1 unknown unknown 2->52 56 Malicious sample detected (through community Yara rule) 2->56 58 Multi AV Scanner detection for dropped file 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 11 other signatures 2->62 8 SecuriteInfo.com.Variant.Tedy.122593.7296.exe 4 6 2->8         started        12 svchost.exe 2->12         started        14 svchost.exe 2->14         started        16 5 other processes 2->16 signatures3 process4 dnsIp5 38 C:\Program Files\Common Files\...\svchost.exe, PE32 8->38 dropped 40 SecuriteInfo.com.V...122593.7296.exe.log, ASCII 8->40 dropped 66 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->66 68 Creates autostart registry keys with suspicious names 8->68 70 Adds a directory exclusion to Windows Defender 8->70 72 Drops PE files with benign system names 8->72 19 SecuriteInfo.com.Variant.Tedy.122593.7296.exe 8->19         started        24 powershell.exe 24 8->24         started        26 powershell.exe 25 8->26         started        28 2 other processes 8->28 42 C:\Windows\Temp\y5zio4ie.inf, Windows 12->42 dropped 44 C:\Windows\Temp\hhhnf0tr.inf, Windows 12->44 dropped 74 Injects a PE file into a foreign processes 12->74 46 C:\Windows\Temp\jcxc0kzm.inf, Windows 14->46 dropped 48 C:\Windows\Temp\axo2mpum.inf, Windows 14->48 dropped 50 192.168.2.1 unknown unknown 16->50 76 Changes security center settings (notifications, updates, antivirus, firewall) 16->76 file6 signatures7 process8 dnsIp9 54 nwme22.duckdns.org 185.220.69.56, 6662 M247GB Romania 19->54 36 C:\Users\user\AppData\Roaming\...\run.dat, data 19->36 dropped 64 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->64 30 conhost.exe 24->30         started        32 conhost.exe 26->32         started        34 conhost.exe 28->34         started        file10 signatures11 process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.220.69.56
 nwme22.duckdns.org Romania
9009 M247GB false

Private

IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
nwme22.duckdns.org 185.220.69.56 true