| Source: Traffic | Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.7:49716 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49716 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49716 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.7:49716 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49716 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.7:49717 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49717 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49717 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.7:49717 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49717 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49718 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49718 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49718 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49718 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49718 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49718 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49719 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49719 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49719 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49719 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49719 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49719 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49720 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49720 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49720 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49720 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49720 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49720 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49721 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49721 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49721 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49721 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49721 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49721 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49722 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49722 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49722 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49722 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49722 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49722 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49723 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49723 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49723 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49723 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49723 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49723 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49724 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49724 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49724 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49724 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49724 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49724 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49725 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49725 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49725 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49725 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49725 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49725 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49726 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49726 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49726 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49726 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49726 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49726 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49727 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49727 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49727 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49727 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49727 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49727 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49728 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49728 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49728 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49728 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49728 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49728 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49729 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49729 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49729 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49729 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49729 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49729 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49730 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49730 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49730 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49730 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49730 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49730 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49731 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49731 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49731 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49731 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49731 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49731 |
| Source: Traffic | Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.7:49732 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.7:49732 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.7:49732 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.7:49732 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.7:49732 -> 141.98.6.102:80 |
| Source: Traffic | Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 141.98.6.102:80 -> 192.168.2.7:49732 |
| Source: SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000002.516579808.0000000001529000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.397774648.00000000009AB000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://crl.globalsign.net/root-r2.crl0 |
| Source: SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000002.521644432.000000000327E000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000002.519732360.0000000003147000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://james.newtonking.com/projects/json |
| Source: powershell.exe, 00000001.00000002.423054874.00000000059BE000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://nuget.org/NuGet.exe |
| Source: powershell.exe, 00000001.00000002.404488163.0000000004A9B000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://pesterbdd.com/images/Pester.png |
| Source: SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000002.518826525.0000000003087000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.401922859.0000000004961000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
| Source: RegAsm.exe, 0000000E.00000002.537381760.00000000004A0000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: http://sedesadre.gq/PKZ/PWS/fre.php |
| Source: powershell.exe, 00000001.00000002.404488163.0000000004A9B000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html |
| Source: svchost.exe, 00000005.00000002.320847106.0000014604A13000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: http://www.bingmapsportal.com |
| Source: SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000002.528024280.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000002.521045812.0000000003211000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000002.527878465.0000000004291000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000E.00000000.513552356.0000000000415000.00000040.00000400.00020000.00000000.sdmp | String found in binary or memory: http://www.ibsensoftware.com/ |
| Source: svchost.exe, 00000005.00000003.319788458.0000014604A5F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net |
| Source: powershell.exe, 00000001.00000002.423054874.00000000059BE000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://contoso.com/ |
| Source: powershell.exe, 00000001.00000002.423054874.00000000059BE000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://contoso.com/Icon |
| Source: powershell.exe, 00000001.00000002.423054874.00000000059BE000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://contoso.com/License |
| Source: svchost.exe, 00000005.00000003.319889828.0000014604A59000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/ |
| Source: svchost.exe, 00000005.00000003.319889828.0000014604A59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.321240546.0000014604A5C000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/ |
| Source: svchost.exe, 00000005.00000003.319788458.0000014604A5F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations |
| Source: svchost.exe, 00000005.00000002.321088494.0000014604A3C000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/ |
| Source: svchost.exe, 00000005.00000003.319889828.0000014604A59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.321240546.0000014604A5C000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/ |
| Source: svchost.exe, 00000005.00000003.319788458.0000014604A5F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx |
| Source: svchost.exe, 00000005.00000002.321163191.0000014604A4E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.319680997.0000014604A48000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v= |
| Source: svchost.exe, 00000005.00000003.319889828.0000014604A59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.321240546.0000014604A5C000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/ |
| Source: svchost.exe, 00000005.00000003.319788458.0000014604A5F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations |
| Source: svchost.exe, 00000005.00000002.321088494.0000014604A3C000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/ |
| Source: svchost.exe, 00000005.00000003.319788458.0000014604A5F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving |
| Source: svchost.exe, 00000005.00000003.319788458.0000014604A5F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit |
| Source: svchost.exe, 00000005.00000003.319788458.0000014604A5F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking |
| Source: svchost.exe, 00000005.00000003.319937311.0000014604A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.321132883.0000014604A42000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/ |
| Source: svchost.exe, 00000005.00000003.319937311.0000014604A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.321132883.0000014604A42000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n= |
| Source: svchost.exe, 00000005.00000003.319788458.0000014604A5F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx |
| Source: svchost.exe, 00000005.00000003.319937311.0000014604A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.319889828.0000014604A59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.321240546.0000014604A5C000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log? |
| Source: svchost.exe, 00000005.00000003.319889828.0000014604A59000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r= |
| Source: svchost.exe, 00000005.00000003.319889828.0000014604A59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.321240546.0000014604A5C000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r= |
| Source: svchost.exe, 00000005.00000003.319889828.0000014604A59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.321240546.0000014604A5C000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r= |
| Source: svchost.exe, 00000005.00000003.319680997.0000014604A48000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dynamic.t |
| Source: svchost.exe, 00000005.00000003.319788458.0000014604A5F000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx |
| Source: svchost.exe, 00000005.00000002.321088494.0000014604A3C000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/ |
| Source: svchost.exe, 00000005.00000003.297637720.0000014604A31000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v= |
| Source: SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000002.519404605.00000000030D1000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://edi4gw.db.files.1drv.com/y4moAVxpkKoBi-6Ib81P-C-8nQTO5eCh6D0sQf0K95pl0pcu4vWhHgGACuDQhzDgbUK |
| Source: SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000002.519404605.00000000030D1000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://edi4gw.db.files.1drv.com4 |
| Source: powershell.exe, 00000001.00000002.404488163.0000000004A9B000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://github.com/Pester/Pester |
| Source: powershell.exe, 00000001.00000002.420135572.00000000051CD000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://go.micro |
| Source: powershell.exe, 00000001.00000002.423054874.00000000059BE000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://nuget.org/nuget.exe |
| Source: SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000002.518826525.0000000003087000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://onedrive.live.com |
| Source: SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000002.518826525.0000000003087000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://onedrive.live.com/download?cid=9A063D4B0D931024&resid=9A063D4B0D931024 |
| Source: SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | String found in binary or memory: https://onedrive.live.com/download?cid=9A063D4B0D931024&resid=9A063D4B0D931024%21128&authkey=AFWFoMk |
| Source: svchost.exe, 00000005.00000002.321088494.0000014604A3C000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx |
| Source: svchost.exe, 00000005.00000002.321088494.0000014604A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.320944817.0000014604A27000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r= |
| Source: svchost.exe, 00000005.00000003.297637720.0000014604A31000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r= |
| Source: svchost.exe, 00000005.00000002.321224479.0000014604A55000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r= |
| Source: svchost.exe, 00000005.00000003.297637720.0000014604A31000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r= |
| Source: svchost.exe, 00000005.00000003.297637720.0000014604A31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.321064418.0000014604A3A000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen |
| Source: svchost.exe, 00000005.00000002.321163191.0000014604A4E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000003.319680997.0000014604A48000.00000004.00000020.00020000.00000000.sdmp | String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen |
| Source: SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000002.531258657.0000000006C30000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000003.490102974.00000000045F2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://www.newtonsoft.com/jsonschema |
| Source: SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000002.531258657.0000000006C30000.00000004.08000000.00040000.00000000.sdmp, SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe, 00000000.00000003.490102974.00000000045F2000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.raw.unpack, type: UNPACKEDPE | Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.raw.unpack, type: UNPACKEDPE | Matched rule: Loki Payload Author: kevoreilly |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.raw.unpack, type: UNPACKEDPE | Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group |
| Source: 14.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen |
| Source: 14.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown |
| Source: 14.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown |
| Source: 14.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Loki Payload Author: kevoreilly |
| Source: 14.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.unpack, type: UNPACKEDPE | Matched rule: Loki Payload Author: kevoreilly |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.unpack, type: UNPACKEDPE | Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.raw.unpack, type: UNPACKEDPE | Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.raw.unpack, type: UNPACKEDPE | Matched rule: Loki Payload Author: kevoreilly |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.raw.unpack, type: UNPACKEDPE | Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.unpack, type: UNPACKEDPE | Matched rule: Loki Payload Author: kevoreilly |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.unpack, type: UNPACKEDPE | Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group |
| Source: 00000000.00000002.521369809.0000000003243000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown |
| Source: 00000000.00000002.528024280.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown |
| Source: 00000000.00000002.528024280.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown |
| Source: 00000000.00000002.528024280.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group |
| Source: 00000000.00000002.521045812.0000000003211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown |
| Source: 00000000.00000002.521045812.0000000003211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown |
| Source: 00000000.00000002.521045812.0000000003211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group |
| Source: 0000000E.00000000.513382566.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown |
| Source: 0000000E.00000000.513552356.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown |
| Source: 00000000.00000002.527878465.0000000004291000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown |
| Source: 00000000.00000002.527878465.0000000004291000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown |
| Source: 00000000.00000002.527878465.0000000004291000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group |
| Source: Process Memory Space: SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe PID: 5092, type: MEMORYSTR | Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown |
| Source: Process Memory Space: RegAsm.exe PID: 2084, type: MEMORYSTR | Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.raw.unpack, type: UNPACKEDPE | Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16 |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.raw.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23 |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23 |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.raw.unpack, type: UNPACKEDPE | Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.raw.unpack, type: UNPACKEDPE | Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research |
| Source: 14.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16 |
| Source: 14.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers |
| Source: 14.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23 |
| Source: 14.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23 |
| Source: 14.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload |
| Source: 14.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE | Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.unpack, type: UNPACKEDPE | Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16 |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23 |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23 |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.unpack, type: UNPACKEDPE | Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.unpack, type: UNPACKEDPE | Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.raw.unpack, type: UNPACKEDPE | Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16 |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.raw.unpack, type: UNPACKEDPE | Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23 |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.raw.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23 |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.raw.unpack, type: UNPACKEDPE | Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.42b9b20.1.raw.unpack, type: UNPACKEDPE | Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.unpack, type: UNPACKEDPE | Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16 |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23 |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.unpack, type: UNPACKEDPE | Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23 |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.unpack, type: UNPACKEDPE | Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload |
| Source: 0.2.SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe.4291b00.0.unpack, type: UNPACKEDPE | Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000000.00000002.521369809.0000000003243000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23 |
| Source: 00000000.00000002.528024280.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23 |
| Source: 00000000.00000002.528024280.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23 |
| Source: 00000000.00000002.528024280.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research |
| Source: 00000000.00000002.521045812.0000000003211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23 |
| Source: 00000000.00000002.521045812.0000000003211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23 |
| Source: 00000000.00000002.521045812.0000000003211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research |
| Source: 0000000E.00000000.513382566.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23 |
| Source: 0000000E.00000000.513552356.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23 |
| Source: 00000000.00000002.527878465.0000000004291000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23 |
| Source: 00000000.00000002.527878465.0000000004291000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23 |
| Source: 00000000.00000002.527878465.0000000004291000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY | Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research |
| Source: Process Memory Space: SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe PID: 5092, type: MEMORYSTR | Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23 |
| Source: Process Memory Space: RegAsm.exe PID: 2084, type: MEMORYSTR | Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23 |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Process information set: NOOPENFILEERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | Process information set: NOGPFAULTERRORBOX | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe VolumeInformation | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation | Jump to behavior |
| Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\ VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation | Jump to behavior |
| Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation | Jump to behavior |
Edit tour
SecuriteInfo.com.Win32.DropperX-gen.15139.3101.exe (PID: 5092 cmdline: 
powershell.exe (PID: 1508 cmdline: 
conhost.exe (PID: 5700 cmdline: 
svchost.exe (PID: 2084 cmdline: 
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node