Windows Analysis Report
DriverUpdt.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: DriverUpdt.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.DriverUpdt.exe.df0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.DriverUpdt.exe.12ff1a78.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.3310295199.0000000012FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.2026730895.0000000000DF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\DriverUpdt, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\DriverUpdt.exe	Code function: 0_2_00007FF848F016E9	0_2_00007FF848F016E9
Source: C:\Users\user\Desktop\DriverUpdt.exe	Code function: 0_2_00007FF848F06E42	0_2_00007FF848F06E42
Source: C:\Users\user\Desktop\DriverUpdt.exe	Code function: 0_2_00007FF848F02361	0_2_00007FF848F02361
Source: C:\Users\user\Desktop\DriverUpdt.exe	Code function: 0_2_00007FF848F06096	0_2_00007FF848F06096
Source: C:\Users\user\Desktop\DriverUpdt.exe	Code function: 0_2_00007FF848F020C1	0_2_00007FF848F020C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848FF30E9	8_2_00007FF848FF30E9
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Code function: 16_2_00007FF848F10E5E	16_2_00007FF848F10E5E
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Code function: 16_2_00007FF848F116E9	16_2_00007FF848F116E9
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Code function: 16_2_00007FF848F120C1	16_2_00007FF848F120C1
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Code function: 20_2_00007FF848F10E5E	20_2_00007FF848F10E5E
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Code function: 20_2_00007FF848F116E9	20_2_00007FF848F116E9
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Code function: 20_2_00007FF848F120C1	20_2_00007FF848F120C1

Source: DriverUpdt.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: DriverUpdt.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.DriverUpdt.exe.df0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.DriverUpdt.exe.12ff1a78.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.3310295199.0000000012FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.2026730895.0000000000DF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\DriverUpdt, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: DriverUpdt.exe, rUq6Jc02GU46qh62C4zZA7O1E0dXcVGvvO.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: DriverUpdt.exe, NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: DriverUpdt.exe, NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: DriverUpdt.0.dr, rUq6Jc02GU46qh62C4zZA7O1E0dXcVGvvO.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: DriverUpdt.0.dr, NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: DriverUpdt.0.dr, NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, rUq6Jc02GU46qh62C4zZA7O1E0dXcVGvvO.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: DriverUpdt.exe, Rh46SGTJYh5nC7MsPl2FieEVPZw16o7SqK.cs	Base64 encoded string: 'Wzyx3ogwisD56ZHkeZYkSrNpO3P9J9Ya4nyydoyDoMhqYbxKcIuCBE6nN3TYLZ2YGky5qwMVXBL9OzBj6saB', 'pEkzOAOMKFgZeEjnqyOdb2Nj9rg4fsl4Zisct4e8rZI8GpWTmVRpZXVefi66KO0FkTsZhrE3OUXpJalOj9B4', 'lGz07EJSsiEZHWKf405VC86ML0pFtcYa9DnDdlCrv8J198USUtFcC4ga0h6D3ane7yoXgP11tbBX4iDkUJeS', 'uzJDSqDxIrlZJqgOgwwy02Dz2doW9zNtgu1RZfT5wLgCGy8fQt7HHJ5u3k7cpPtrQjj193zWKo4RHGr1PzX7', 'kqsk7TjkQbOMRQH2P9ywEPNbF2r2incAMN3K1h9sJhx31ygvXxpPnN8wj2WFZsTUvvige5ObtRYEs6EG9D5d', 'P3jsV4lZMIEXKaHtWScW7lMfH1M7bVzOGpyPzhtflSe30EwumuBRdb6vTpfKTXnCs0EyLA83RPn8nmd7hA8r', 'k4IiQb8aZFjA4MsRFkE6P0TsgsiT9f6t02Ntz9sOgXWs0Nq6T70LKbhfkD5ShI8LUSrbaaQww9YO7IZrSXnF', 'xvJbDZCgm7lSnBhfxWOa8zS4w0526chcn7corNxa5cWF1mWYKadtQLF52nm6cGvwuyZd0azWMYzWeLS9lcev', 'Kj3Vb6PzHn9v07t3S0MWBznTXF1PkRT8IPHe7b7iUzNIQpLOGQIuf7Qw6sSjOHLy50aTBV6HbQz1FEQxMDre', 'QKbzE0YySm8lR0erhsq4rtsTMCTOH8uWKlTWQEr6qzkkxB0tXX13kESSZQ0TzkUiVIYEu9h6AFhoAozuHLGP'
Source: DriverUpdt.exe, 2uBhJ8fSv8l0pNFJnFq2SeR3AXe9pdtb8Z.cs	Base64 encoded string: 'uJIvKPRumgeUE7Cj6DUpv9OS9X3euISjlVu8QNQtltUm2IG3Y0JmlsPYPr5ci66SF5osCsrOnJPEtcePD1G1', 'XeZ2r4uLure0d6onZjoTUSlru3HjQ20XzQZ05KOuHMRAI6ctSnZGwEZJRRG3M7UxX1RD9uBRKZCu43NqpXe9'
Source: DriverUpdt.exe, e95G2DjFXzv6C0eArUQts1cNIeQlL39BGnN7z8xoz5lRERj07.cs	Base64 encoded string: 'RjaJGu3nFKjVX0HwnYwB9ectK5a6EyZDqeBpbfJVcWXzgU7cxwmplntKZbqu70u0hbw0FnnivfvskcF74o3X', 'IvZAem83h4vgpUmTHT5k0SVSUCWlugncvsAt7ObcW3MuzF5eUytFamzZuiXrAub6g02Vm5QmfvQ2cwbqj4la', 'JehyPCnBuflDs2d0ZYefcjO4JfBTQCC4HLKDhjmywyJhsaF0ReTf1GJEjxEzRWayaHAHaLzPSew8mvgAY6FW'
Source: DriverUpdt.exe, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	Base64 encoded string: 'QgYbC2WdwKektmrwVSQXk6yB1NWvPEcjEeToyahhlq2wGd2keQrLxcDZTSUuhiqBwcodSszv1cFVZTcbLUYG', 'LOItW6SfTfvWaylwjhr8yEPSu2oJNoipfHWhndegtyONdycme84WEpTTBJJRvJ2U0rJMqbypLQZqriyuT7ZF', 't4S9tOQRYlNxhhE3lGaEFj9w0rrpGEgUSTZZoE66qxJZ7b8bKsn3G7Mt5X3S0ek8qgwVxv0K2Nh0JtU10dzU', 'Gr0dgRT9Isqyej2OaWxQTnFzKcx1kBFZ5uOIm80jhCWNMjPhceWcm9NnYdffK4fsEtvcysr7sg1JiNCeAf8F', 'NlazytOCkJxJwpVPk1IrAOFlMhiOhspVn63UIEtpMtwhm3FYRAiovb3P0X46ChDgHL0EIk7IlbjJnl1lAeS7', 'NUuBK0NmuFzZbbySSf5FK8kHSSZm0lufbsLrlhDw5HpjaxmbDuT0LtPUl0dFcrMkO9oaw5pmkxmCP9GSEUPg', 'hiHZ8Pnec7U0fALizQIaJmM6g8cZwU9aRArhJKGki3eSsi1UsFEfwmhnDyDHSgK1m4pfZlBfNclcdrv7bGOQ', 'tMDOOGYeG5UTwVFxUwxNGqt9UgalFlhCPr2mz5FNJOQTPvRS97rqk0cdnmliTYB2t7MMupqVM3IJOmtdq0Y7', 'rirOR0AtWALUZeGM2S5EWjWocdeAroBLyFZ79l6Q2bnUw3TvKnxQ0OvfPOdvMFlZbOQj5fQM5duB2nBRcjaB'
Source: DriverUpdt.0.dr, Rh46SGTJYh5nC7MsPl2FieEVPZw16o7SqK.cs	Base64 encoded string: 'Wzyx3ogwisD56ZHkeZYkSrNpO3P9J9Ya4nyydoyDoMhqYbxKcIuCBE6nN3TYLZ2YGky5qwMVXBL9OzBj6saB', 'pEkzOAOMKFgZeEjnqyOdb2Nj9rg4fsl4Zisct4e8rZI8GpWTmVRpZXVefi66KO0FkTsZhrE3OUXpJalOj9B4', 'lGz07EJSsiEZHWKf405VC86ML0pFtcYa9DnDdlCrv8J198USUtFcC4ga0h6D3ane7yoXgP11tbBX4iDkUJeS', 'uzJDSqDxIrlZJqgOgwwy02Dz2doW9zNtgu1RZfT5wLgCGy8fQt7HHJ5u3k7cpPtrQjj193zWKo4RHGr1PzX7', 'kqsk7TjkQbOMRQH2P9ywEPNbF2r2incAMN3K1h9sJhx31ygvXxpPnN8wj2WFZsTUvvige5ObtRYEs6EG9D5d', 'P3jsV4lZMIEXKaHtWScW7lMfH1M7bVzOGpyPzhtflSe30EwumuBRdb6vTpfKTXnCs0EyLA83RPn8nmd7hA8r', 'k4IiQb8aZFjA4MsRFkE6P0TsgsiT9f6t02Ntz9sOgXWs0Nq6T70LKbhfkD5ShI8LUSrbaaQww9YO7IZrSXnF', 'xvJbDZCgm7lSnBhfxWOa8zS4w0526chcn7corNxa5cWF1mWYKadtQLF52nm6cGvwuyZd0azWMYzWeLS9lcev', 'Kj3Vb6PzHn9v07t3S0MWBznTXF1PkRT8IPHe7b7iUzNIQpLOGQIuf7Qw6sSjOHLy50aTBV6HbQz1FEQxMDre', 'QKbzE0YySm8lR0erhsq4rtsTMCTOH8uWKlTWQEr6qzkkxB0tXX13kESSZQ0TzkUiVIYEu9h6AFhoAozuHLGP'
Source: DriverUpdt.0.dr, 2uBhJ8fSv8l0pNFJnFq2SeR3AXe9pdtb8Z.cs	Base64 encoded string: 'uJIvKPRumgeUE7Cj6DUpv9OS9X3euISjlVu8QNQtltUm2IG3Y0JmlsPYPr5ci66SF5osCsrOnJPEtcePD1G1', 'XeZ2r4uLure0d6onZjoTUSlru3HjQ20XzQZ05KOuHMRAI6ctSnZGwEZJRRG3M7UxX1RD9uBRKZCu43NqpXe9'
Source: DriverUpdt.0.dr, e95G2DjFXzv6C0eArUQts1cNIeQlL39BGnN7z8xoz5lRERj07.cs	Base64 encoded string: 'RjaJGu3nFKjVX0HwnYwB9ectK5a6EyZDqeBpbfJVcWXzgU7cxwmplntKZbqu70u0hbw0FnnivfvskcF74o3X', 'IvZAem83h4vgpUmTHT5k0SVSUCWlugncvsAt7ObcW3MuzF5eUytFamzZuiXrAub6g02Vm5QmfvQ2cwbqj4la', 'JehyPCnBuflDs2d0ZYefcjO4JfBTQCC4HLKDhjmywyJhsaF0ReTf1GJEjxEzRWayaHAHaLzPSew8mvgAY6FW'
Source: DriverUpdt.0.dr, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	Base64 encoded string: 'QgYbC2WdwKektmrwVSQXk6yB1NWvPEcjEeToyahhlq2wGd2keQrLxcDZTSUuhiqBwcodSszv1cFVZTcbLUYG', 'LOItW6SfTfvWaylwjhr8yEPSu2oJNoipfHWhndegtyONdycme84WEpTTBJJRvJ2U0rJMqbypLQZqriyuT7ZF', 't4S9tOQRYlNxhhE3lGaEFj9w0rrpGEgUSTZZoE66qxJZ7b8bKsn3G7Mt5X3S0ek8qgwVxv0K2Nh0JtU10dzU', 'Gr0dgRT9Isqyej2OaWxQTnFzKcx1kBFZ5uOIm80jhCWNMjPhceWcm9NnYdffK4fsEtvcysr7sg1JiNCeAf8F', 'NlazytOCkJxJwpVPk1IrAOFlMhiOhspVn63UIEtpMtwhm3FYRAiovb3P0X46ChDgHL0EIk7IlbjJnl1lAeS7', 'NUuBK0NmuFzZbbySSf5FK8kHSSZm0lufbsLrlhDw5HpjaxmbDuT0LtPUl0dFcrMkO9oaw5pmkxmCP9GSEUPg', 'hiHZ8Pnec7U0fALizQIaJmM6g8cZwU9aRArhJKGki3eSsi1UsFEfwmhnDyDHSgK1m4pfZlBfNclcdrv7bGOQ', 'tMDOOGYeG5UTwVFxUwxNGqt9UgalFlhCPr2mz5FNJOQTPvRS97rqk0cdnmliTYB2t7MMupqVM3IJOmtdq0Y7', 'rirOR0AtWALUZeGM2S5EWjWocdeAroBLyFZ79l6Q2bnUw3TvKnxQ0OvfPOdvMFlZbOQj5fQM5duB2nBRcjaB'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, Rh46SGTJYh5nC7MsPl2FieEVPZw16o7SqK.cs	Base64 encoded string: 'Wzyx3ogwisD56ZHkeZYkSrNpO3P9J9Ya4nyydoyDoMhqYbxKcIuCBE6nN3TYLZ2YGky5qwMVXBL9OzBj6saB', 'pEkzOAOMKFgZeEjnqyOdb2Nj9rg4fsl4Zisct4e8rZI8GpWTmVRpZXVefi66KO0FkTsZhrE3OUXpJalOj9B4', 'lGz07EJSsiEZHWKf405VC86ML0pFtcYa9DnDdlCrv8J198USUtFcC4ga0h6D3ane7yoXgP11tbBX4iDkUJeS', 'uzJDSqDxIrlZJqgOgwwy02Dz2doW9zNtgu1RZfT5wLgCGy8fQt7HHJ5u3k7cpPtrQjj193zWKo4RHGr1PzX7', 'kqsk7TjkQbOMRQH2P9ywEPNbF2r2incAMN3K1h9sJhx31ygvXxpPnN8wj2WFZsTUvvige5ObtRYEs6EG9D5d', 'P3jsV4lZMIEXKaHtWScW7lMfH1M7bVzOGpyPzhtflSe30EwumuBRdb6vTpfKTXnCs0EyLA83RPn8nmd7hA8r', 'k4IiQb8aZFjA4MsRFkE6P0TsgsiT9f6t02Ntz9sOgXWs0Nq6T70LKbhfkD5ShI8LUSrbaaQww9YO7IZrSXnF', 'xvJbDZCgm7lSnBhfxWOa8zS4w0526chcn7corNxa5cWF1mWYKadtQLF52nm6cGvwuyZd0azWMYzWeLS9lcev', 'Kj3Vb6PzHn9v07t3S0MWBznTXF1PkRT8IPHe7b7iUzNIQpLOGQIuf7Qw6sSjOHLy50aTBV6HbQz1FEQxMDre', 'QKbzE0YySm8lR0erhsq4rtsTMCTOH8uWKlTWQEr6qzkkxB0tXX13kESSZQ0TzkUiVIYEu9h6AFhoAozuHLGP'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, 2uBhJ8fSv8l0pNFJnFq2SeR3AXe9pdtb8Z.cs	Base64 encoded string: 'uJIvKPRumgeUE7Cj6DUpv9OS9X3euISjlVu8QNQtltUm2IG3Y0JmlsPYPr5ci66SF5osCsrOnJPEtcePD1G1', 'XeZ2r4uLure0d6onZjoTUSlru3HjQ20XzQZ05KOuHMRAI6ctSnZGwEZJRRG3M7UxX1RD9uBRKZCu43NqpXe9'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, e95G2DjFXzv6C0eArUQts1cNIeQlL39BGnN7z8xoz5lRERj07.cs	Base64 encoded string: 'RjaJGu3nFKjVX0HwnYwB9ectK5a6EyZDqeBpbfJVcWXzgU7cxwmplntKZbqu70u0hbw0FnnivfvskcF74o3X', 'IvZAem83h4vgpUmTHT5k0SVSUCWlugncvsAt7ObcW3MuzF5eUytFamzZuiXrAub6g02Vm5QmfvQ2cwbqj4la', 'JehyPCnBuflDs2d0ZYefcjO4JfBTQCC4HLKDhjmywyJhsaF0ReTf1GJEjxEzRWayaHAHaLzPSew8mvgAY6FW'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	Base64 encoded string: 'QgYbC2WdwKektmrwVSQXk6yB1NWvPEcjEeToyahhlq2wGd2keQrLxcDZTSUuhiqBwcodSszv1cFVZTcbLUYG', 'LOItW6SfTfvWaylwjhr8yEPSu2oJNoipfHWhndegtyONdycme84WEpTTBJJRvJ2U0rJMqbypLQZqriyuT7ZF', 't4S9tOQRYlNxhhE3lGaEFj9w0rrpGEgUSTZZoE66qxJZ7b8bKsn3G7Mt5X3S0ek8qgwVxv0K2Nh0JtU10dzU', 'Gr0dgRT9Isqyej2OaWxQTnFzKcx1kBFZ5uOIm80jhCWNMjPhceWcm9NnYdffK4fsEtvcysr7sg1JiNCeAf8F', 'NlazytOCkJxJwpVPk1IrAOFlMhiOhspVn63UIEtpMtwhm3FYRAiovb3P0X46ChDgHL0EIk7IlbjJnl1lAeS7', 'NUuBK0NmuFzZbbySSf5FK8kHSSZm0lufbsLrlhDw5HpjaxmbDuT0LtPUl0dFcrMkO9oaw5pmkxmCP9GSEUPg', 'hiHZ8Pnec7U0fALizQIaJmM6g8cZwU9aRArhJKGki3eSsi1UsFEfwmhnDyDHSgK1m4pfZlBfNclcdrv7bGOQ', 'tMDOOGYeG5UTwVFxUwxNGqt9UgalFlhCPr2mz5FNJOQTPvRS97rqk0cdnmliTYB2t7MMupqVM3IJOmtdq0Y7', 'rirOR0AtWALUZeGM2S5EWjWocdeAroBLyFZ79l6Q2bnUw3TvKnxQ0OvfPOdvMFlZbOQj5fQM5duB2nBRcjaB'

Source: DriverUpdt.exe, e95G2DjFXzv6C0eArUQts1cNIeQlL39BGnN7z8xoz5lRERj07.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: DriverUpdt.exe, e95G2DjFXzv6C0eArUQts1cNIeQlL39BGnN7z8xoz5lRERj07.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: DriverUpdt.0.dr, e95G2DjFXzv6C0eArUQts1cNIeQlL39BGnN7z8xoz5lRERj07.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: DriverUpdt.0.dr, e95G2DjFXzv6C0eArUQts1cNIeQlL39BGnN7z8xoz5lRERj07.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, e95G2DjFXzv6C0eArUQts1cNIeQlL39BGnN7z8xoz5lRERj07.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, e95G2DjFXzv6C0eArUQts1cNIeQlL39BGnN7z8xoz5lRERj07.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@21/25@2/3

Source: C:\Users\user\Desktop\DriverUpdt.exe

File created: C:\Users\user\AppData\Roaming\DriverUpdt

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1216:120:WilError_03
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Mutant created: NULL
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:320:120:WilError_03
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5856:120:WilError_03
Source: C:\Users\user\Desktop\DriverUpdt.exe	Mutant created: \Sessions\1\BaseNamedObjects\4fPEH1k67YijypJe
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6208:120:WilError_03

Source: C:\Users\user\Desktop\DriverUpdt.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Source: DriverUpdt.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DriverUpdt.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\DriverUpdt.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\DriverUpdt.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: DriverUpdt.exe

ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\DriverUpdt.exe

File read: C:\Users\user\Desktop\DriverUpdt.exe

Source: unknown	Process created: C:\Users\user\Desktop\DriverUpdt.exe "C:\Users\user\Desktop\DriverUpdt.exe"
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\DriverUpdt.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DriverUpdt.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\DriverUpdt'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DriverUpdt'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DriverUpdt" /tr "C:\Users\user\AppData\Roaming\DriverUpdt"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\DriverUpdt C:\Users\user\AppData\Roaming\DriverUpdt
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\DriverUpdt C:\Users\user\AppData\Roaming\DriverUpdt
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\DriverUpdt.exe'	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DriverUpdt.exe'	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\DriverUpdt'	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DriverUpdt'	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DriverUpdt" /tr "C:\Users\user\AppData\Roaming\DriverUpdt"	Jump to behavior

Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: cryptbase.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\DriverUpdt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: DriverUpdt.lnk.0.dr

LNK file: ..\..\..\..\..\DriverUpdt

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: DriverUpdt.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DriverUpdt.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: DriverUpdt.exe, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.kXvcjdmVY4zjRWVFXC3lBrUcBHK4LAN0d47tJ5k2LEuQI0mzt,ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.xlbB3IbMaqdUb2n0f0CvPr61P2Uptm2pFO2H7q1xFeivbGFh0,ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.KoNhKT39GT3lTIAfnbUdSyhuO0g2ooVUvR5NzfWgg3mVI2B2w,ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.Xvf6QwUCtc6L1cEQe7heHcbBSCrayGp1BvJwaxebNPVDIH7VA,NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.hjZApXRfz1grdXI3WWGkQZSNuyC952qG2G()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: DriverUpdt.exe, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{HnOI27tkAMX6BEYQ5c0dCqgg9gwbEKNpxj[2],NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.kLWkQWPCFdYmVqccyS5xT7N08VG3zFjVGo(Convert.FromBase64String(HnOI27tkAMX6BEYQ5c0dCqgg9gwbEKNpxj[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: DriverUpdt.exe, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { HnOI27tkAMX6BEYQ5c0dCqgg9gwbEKNpxj[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: DriverUpdt.0.dr, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.kXvcjdmVY4zjRWVFXC3lBrUcBHK4LAN0d47tJ5k2LEuQI0mzt,ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.xlbB3IbMaqdUb2n0f0CvPr61P2Uptm2pFO2H7q1xFeivbGFh0,ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.KoNhKT39GT3lTIAfnbUdSyhuO0g2ooVUvR5NzfWgg3mVI2B2w,ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.Xvf6QwUCtc6L1cEQe7heHcbBSCrayGp1BvJwaxebNPVDIH7VA,NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.hjZApXRfz1grdXI3WWGkQZSNuyC952qG2G()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: DriverUpdt.0.dr, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{HnOI27tkAMX6BEYQ5c0dCqgg9gwbEKNpxj[2],NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.kLWkQWPCFdYmVqccyS5xT7N08VG3zFjVGo(Convert.FromBase64String(HnOI27tkAMX6BEYQ5c0dCqgg9gwbEKNpxj[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: DriverUpdt.0.dr, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { HnOI27tkAMX6BEYQ5c0dCqgg9gwbEKNpxj[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.kXvcjdmVY4zjRWVFXC3lBrUcBHK4LAN0d47tJ5k2LEuQI0mzt,ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.xlbB3IbMaqdUb2n0f0CvPr61P2Uptm2pFO2H7q1xFeivbGFh0,ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.KoNhKT39GT3lTIAfnbUdSyhuO0g2ooVUvR5NzfWgg3mVI2B2w,ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.Xvf6QwUCtc6L1cEQe7heHcbBSCrayGp1BvJwaxebNPVDIH7VA,NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.hjZApXRfz1grdXI3WWGkQZSNuyC952qG2G()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{HnOI27tkAMX6BEYQ5c0dCqgg9gwbEKNpxj[2],NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.kLWkQWPCFdYmVqccyS5xT7N08VG3zFjVGo(Convert.FromBase64String(HnOI27tkAMX6BEYQ5c0dCqgg9gwbEKNpxj[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { HnOI27tkAMX6BEYQ5c0dCqgg9gwbEKNpxj[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: DriverUpdt.exe, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: nVAtaQnZ6l6nBm3lJhzBnKxeTFQmUXn7zcx5uYC0wgSdqcy9h System.AppDomain.Load(byte[])
Source: DriverUpdt.exe, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: wiXI9ZeBaRPpjQ8CLnKLl1DIpheP6IkVK8A66QkxgTDLdoWbM System.AppDomain.Load(byte[])
Source: DriverUpdt.exe, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: wiXI9ZeBaRPpjQ8CLnKLl1DIpheP6IkVK8A66QkxgTDLdoWbM
Source: DriverUpdt.0.dr, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: nVAtaQnZ6l6nBm3lJhzBnKxeTFQmUXn7zcx5uYC0wgSdqcy9h System.AppDomain.Load(byte[])
Source: DriverUpdt.0.dr, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: wiXI9ZeBaRPpjQ8CLnKLl1DIpheP6IkVK8A66QkxgTDLdoWbM System.AppDomain.Load(byte[])
Source: DriverUpdt.0.dr, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: wiXI9ZeBaRPpjQ8CLnKLl1DIpheP6IkVK8A66QkxgTDLdoWbM
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: nVAtaQnZ6l6nBm3lJhzBnKxeTFQmUXn7zcx5uYC0wgSdqcy9h System.AppDomain.Load(byte[])
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: wiXI9ZeBaRPpjQ8CLnKLl1DIpheP6IkVK8A66QkxgTDLdoWbM System.AppDomain.Load(byte[])
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	.Net Code: wiXI9ZeBaRPpjQ8CLnKLl1DIpheP6IkVK8A66QkxgTDLdoWbM

Source: C:\Users\user\Desktop\DriverUpdt.exe	Code function: 0_2_00007FF848F000BD pushad ; iretd	0_2_00007FF848F000C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848E0D2A5 pushad ; iretd	2_2_00007FF848E0D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F20DA0 pushad ; retf	2_2_00007FF848F20E0D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F200BD pushad ; iretd	2_2_00007FF848F200C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848DED2A5 pushad ; iretd	5_2_00007FF848DED2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF848F000BD pushad ; iretd	5_2_00007FF848F000C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848E0D2A5 pushad ; iretd	8_2_00007FF848E0D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848F2B9FA push E85A2FD7h; ret	8_2_00007FF848F2BAF9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848F200BD pushad ; iretd	8_2_00007FF848F200C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF848E0D2A5 pushad ; iretd	10_2_00007FF848E0D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF848F200BD pushad ; iretd	10_2_00007FF848F200C1
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Code function: 16_2_00007FF848F100BD pushad ; iretd	16_2_00007FF848F100C1
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Code function: 20_2_00007FF848F100BD pushad ; iretd	20_2_00007FF848F100C1

Source: DriverUpdt.exe, 0f5wN5iaksWJx8oMfJnXxCNtYs1IH8rt9K.cs	High entropy of concatenated method names: 'opDBjU1PODJbkaegdOB16WOFLY3mQwEdEl', 'a8JZBv7fLLr1RdVHhT7X73eC6HVDEuyzz5', '_0b9JnZEwICj7AGlBNURRztqML9SXeOZXL7', 'ATm6kN4FZHBZVfWhdbiVl10mjT', 'VD7JRi8WA6tNsZYOCrtsYfuvZV', '_55RVfoVYvecnmerTVPbxQt16vz', 'fW22Fiwx3IERa8JUW4qOSSwnFO', 'QPB9P6GSY9LK8xuIoVRml4j6MF', 'gzqTCi4f8OAhTPJItNGigaUu0T', 'XpA5SrtJGG2wBuUMwtKaY0RP2E'
Source: DriverUpdt.exe, ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.cs	High entropy of concatenated method names: 'avahQgg4hRxzX9sWEUVQHLXmMpxnnFQiZAhATcEne8jNC3GaHS6apCiUPFDRZ2tiMU', 'iiFlDfMB5MyGNa4QvvKZTieUzrznlepuhAftVwpjHqQyaIbiUMOa0yDQeLU5ZDvfvt', 'jSKnBOXrdi9UB1TQioMoUO8q6XAJicBEgFkb8UwhJy2Q2On2QORUreQXzhgeuvAnUh', 'MUGBiOpCAZALg18jYxbZem3mEJnIrJwCh5qELe8nZUzaT18guOceKdRTXNILt3qGh4'
Source: DriverUpdt.exe, ItGbRSbZFa55CcXB.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_0Love8mNF6aQdUOwBy38dDjl1YTHDjVbSbOLcprgBKwiaR9GQJqhsr24QGQFBc7oR5', '_5CSekGcVzZeoXZVENEqxcwNMvwPPZKiVqsUftGWbLqoK0sGqe9F3gVvJh1EQlCCqY4', 'Ht267XslWyBGNwGKM8CnIlTTlhouBGyJmbW8Udltu3AppwidYGJJMEneGlGyg7L0u0', 'KWl0mfZs0Dl0gfgooBpj0tseVrhreDSUzs9bW3ppX0z5NFwdu7aM7NIm4QF3v9wRy3'
Source: DriverUpdt.exe, Rh46SGTJYh5nC7MsPl2FieEVPZw16o7SqK.cs	High entropy of concatenated method names: 'APq8HycpkPPjuDvi1sU0rjrQUmaVP3ID5K', 'UAc4yzzQ0GHVyuqxYwn0WWNqNW5YVXEX1T', '_7GJx3tULSMI6DNglNBPRFZnT7FpG6XxC24', 'oNjeO3ZFk0i7KeWtYzLT6DEYzx5EIl1Skx', 'Hivj6AHvQE9Mw9dvVggOg6jXbqNcPsJN8t', 'suBZaleEhn3iSaelJmGDY5DltNl5Tewq00', 'VDkCCL325lQjGKNJKk7TBL2Udz2oezOxb9', '_0YZbHdatVdNEN8nbiS8yT54eVWO30E8DWa', 'lp9NjEbIPxs9pF55qE3jVLzvblspVcvmaH', 'UhWxUNDlFThOwjYPG0l0acHFr5NePqj52e'
Source: DriverUpdt.exe, IxmT2WkPyORcZnISbnQeQ4J3xaAS3FBXxGK6ZtWktXuanuHSX.cs	High entropy of concatenated method names: 'BLM3rzpZtmjMMu9ZsUHeoVBJXmNvFTRdmUqRb7gYZvnQ023Cc', 'nh3KsCg04VCVMQzVX4yaL58h78ZCZR8yeuPao0ZRQAzQQfuhq', 'NSMkFOzg0rZ6YqpPV3jZhKbGaQFdPWF29l6I6P5YFrOgeKbV8', 'qs9Wu1E0FPVMQycOn1HJaAUJedRWZGda7UWzDgSkpWktqMZgy', 'QGfHhiirzqTpJFc5NkDUvgJg31bxC7yQtXexVJne2avAwOXKL', 'srbGpOt4IdjtvS1TwXRlvnc4c4gMPvIdCsO2p4tYzwPFtKHXP', '_3R8LTyvp37xGDVBNwmZfDvT0LDKI8CQ47hU8sbKhfmLlIZKVY', 'KrQ81CshIb95AY55FoK2Ee1LRHguA1kYew6tgd9j5l5CANh0s', '_80T3zQuCLmB5ehw5g8EaUt5gzDf0cydzCZVGIXQu9VyAEKVE0', 'lwJG5dNm7w2PzL4a9SPA0hMi69md5pEaJwj1OuoGCf6fCECxc'
Source: DriverUpdt.exe, 2uBhJ8fSv8l0pNFJnFq2SeR3AXe9pdtb8Z.cs	High entropy of concatenated method names: 'Mdt9l9R8TF7ur7Pv30sF3z8cCt5ncWgSUS', '_70nnctB0EBs6NssjjTsDMAAfcZ4iiAEHaKkdAz63u5sgFONvGoKYnEmvZ5kohXRXUz207sWNz3P5dlDx9Qoo', 'olVlEttCG0PtcKVJ8QXyt4BxeUf13GiNneDO1Ctkq1AIuJ4jSloNmWQLAFcjbp6aLg3WjEOqU8zoAegrngbA', 'wrAbldAE7kHEx7Kx4FEe3dRz4nBQPFr3j0wvR6guJ9wnN4TTAfdOIU7cMx35Pohmhy8fRwMzE86QOEJ0V5ax', 'FXknOpZ2o73XPQpP4mWAElExaLv4JJSMQlVlXT1MA9uK3rCo7i2DNomtuzlFOQCjOIXboCjQ1fNpJeyi5KAF'
Source: DriverUpdt.exe, e95G2DjFXzv6C0eArUQts1cNIeQlL39BGnN7z8xoz5lRERj07.cs	High entropy of concatenated method names: 'ikzeM2JjEiTZLrO4eUCXFnU3WhiotWH5eWDkWpRierwdr2jWl', 'YsZjJgGxZhrccUsYXC98oaLNoqPds9pMA56yCOIGchvARkPK3', '_9qYRdciTZi8i7BmpK0OOQJbLuUfk0z6ikVdYd1DyqBjlzB5Vx', 'xjT7ceg8SwwL3sI8Prh56VIZ0ES3HiNdmbcU8Cm75DFqlG2OS', 'ttlJyRRizCsAKjUHv21YMfaAgQrItnUt936IpaaS0IWCuuL79', '_7lBB1vY9590PUwREPO2XQ9Ta2N4rUi5ZXMjenqB87tjDhYrpf', 'Gv9IXoYTxUOMuYnNNc8bmf2rD4vZWhXeT8NBsI5cfmsvPkd9T', 'yBGjAMx4IrJ4aBRYYrLAGIaGfZ84WjDxBONjZCVTj7f3O6dzv', 'Inhu2x7FoMBVe9FuhOGNS6bRyCxJrr4oKyVkAtDg2IcXXlICq', 'Vb2OtZ2mFtvBXdxk6W24bVlMj4TR0t2hjt8ZveELUelgwbLWo'
Source: DriverUpdt.exe, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	High entropy of concatenated method names: 'ildmhkmnbomr0mhRclue73B4mqDqfe2JCONbWZi8jSg3MtK5L', 'nVAtaQnZ6l6nBm3lJhzBnKxeTFQmUXn7zcx5uYC0wgSdqcy9h', 'eBRTBiiKlaBa0nndhupVEfasKgyUQgsIYVjXrOAxWRHbx97Yy', 'xDDAcd24X0UM0InsZAzkXyNlZC0y1oxxZs08YSlDl5W7voDP9', '_9x3bq69WpSh2QEbPgy13f3Thf8mb07YJXQtTgORxCaKVouQ7r', 'DRBpVHXHuIDdraLjtTW3ud5dBP9RMkpv0ICIvukFEz8OdD914', 'Cm1g9Xqe6mvRnFJHFdCeAoPaFcp8RFYtH4OyMNAh2ZrNktAKB', 'zycGKiBG1PdklsIFy5rda165WUVvnKSgGnjiWxqJMhFCyfF6L', 'lLd9DKzpQ9cOwBL2Cqz03ESn4JJdLZlGGegBMZAEgRLcpbTLz', 'qEejvT4kIexfScEWiaTm5ayBpThzE6FSO130Sq9CSehtYMKy0'
Source: DriverUpdt.exe, NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.cs	High entropy of concatenated method names: 'j70LpoWliDlcDxqBLr7QPUVmRwzEZZSB5Q', 'XjyxFp9w2yxFP7yagokte9Txm6vSpEwZvu', 'xsIANs6XzK9V9g4bVJ7oYf2yaC2F6Zdoui', 'SCYpS2v9ZMrHbvPKUkLCFTdqvJwrWL6UIq', 'Gn3LPYcAEH4fT4FDq0lYO2pqy1ZyTAMzHJ', 'wqOdlSLJYxuGSGNkBiX4qpJaeYvgLOEtyT', 'YPaFf6ag4KSOtFiZYcsP8kSHEABZbUeg0Y', 'W5kNoQ1Lru1E9kA2mBElGDjEiNqtw2kYzY', 'Fg7NzeJUpyCxTbjekUC33MYJZYr1kYncAM', 'JPViTqXldagtsTNADEBTIiJu1dzXJmcJ3g'
Source: DriverUpdt.exe, wOOq5bB92Ba7ooz2WkCQzTmIBUxVaDWziB.cs	High entropy of concatenated method names: 'R4qUnPzsX0NNtkNpbJLbOefCNgIn8Khuyn', 'wJMZ8oQvfLskpob9at41iUQcenI8WcFxS1', 'JDj0bhNXMA4oVfZMP8tr1xDpOnCEknUWCj', 'VSLvHoxKCl8UT61ZJzsYVNx0hIvaK5Draj', '_88qow1UlAh03CWPLgNcWynEtzl', 'clcGaDtaQDW3m5zqoXpsOYFE0S', '_652Oz4ZQx0IEy53L0DdCU8bVhA', 'MV4RQrPbq6IgaySoRPKtxrBaex', 'TDpTfW2S1YbyGXkCojqO0lNSsq', 'joZe4kEAR1UlntbknsLA6l9pCX'
Source: DriverUpdt.0.dr, 0f5wN5iaksWJx8oMfJnXxCNtYs1IH8rt9K.cs	High entropy of concatenated method names: 'opDBjU1PODJbkaegdOB16WOFLY3mQwEdEl', 'a8JZBv7fLLr1RdVHhT7X73eC6HVDEuyzz5', '_0b9JnZEwICj7AGlBNURRztqML9SXeOZXL7', 'ATm6kN4FZHBZVfWhdbiVl10mjT', 'VD7JRi8WA6tNsZYOCrtsYfuvZV', '_55RVfoVYvecnmerTVPbxQt16vz', 'fW22Fiwx3IERa8JUW4qOSSwnFO', 'QPB9P6GSY9LK8xuIoVRml4j6MF', 'gzqTCi4f8OAhTPJItNGigaUu0T', 'XpA5SrtJGG2wBuUMwtKaY0RP2E'
Source: DriverUpdt.0.dr, ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.cs	High entropy of concatenated method names: 'avahQgg4hRxzX9sWEUVQHLXmMpxnnFQiZAhATcEne8jNC3GaHS6apCiUPFDRZ2tiMU', 'iiFlDfMB5MyGNa4QvvKZTieUzrznlepuhAftVwpjHqQyaIbiUMOa0yDQeLU5ZDvfvt', 'jSKnBOXrdi9UB1TQioMoUO8q6XAJicBEgFkb8UwhJy2Q2On2QORUreQXzhgeuvAnUh', 'MUGBiOpCAZALg18jYxbZem3mEJnIrJwCh5qELe8nZUzaT18guOceKdRTXNILt3qGh4'
Source: DriverUpdt.0.dr, ItGbRSbZFa55CcXB.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_0Love8mNF6aQdUOwBy38dDjl1YTHDjVbSbOLcprgBKwiaR9GQJqhsr24QGQFBc7oR5', '_5CSekGcVzZeoXZVENEqxcwNMvwPPZKiVqsUftGWbLqoK0sGqe9F3gVvJh1EQlCCqY4', 'Ht267XslWyBGNwGKM8CnIlTTlhouBGyJmbW8Udltu3AppwidYGJJMEneGlGyg7L0u0', 'KWl0mfZs0Dl0gfgooBpj0tseVrhreDSUzs9bW3ppX0z5NFwdu7aM7NIm4QF3v9wRy3'
Source: DriverUpdt.0.dr, Rh46SGTJYh5nC7MsPl2FieEVPZw16o7SqK.cs	High entropy of concatenated method names: 'APq8HycpkPPjuDvi1sU0rjrQUmaVP3ID5K', 'UAc4yzzQ0GHVyuqxYwn0WWNqNW5YVXEX1T', '_7GJx3tULSMI6DNglNBPRFZnT7FpG6XxC24', 'oNjeO3ZFk0i7KeWtYzLT6DEYzx5EIl1Skx', 'Hivj6AHvQE9Mw9dvVggOg6jXbqNcPsJN8t', 'suBZaleEhn3iSaelJmGDY5DltNl5Tewq00', 'VDkCCL325lQjGKNJKk7TBL2Udz2oezOxb9', '_0YZbHdatVdNEN8nbiS8yT54eVWO30E8DWa', 'lp9NjEbIPxs9pF55qE3jVLzvblspVcvmaH', 'UhWxUNDlFThOwjYPG0l0acHFr5NePqj52e'
Source: DriverUpdt.0.dr, IxmT2WkPyORcZnISbnQeQ4J3xaAS3FBXxGK6ZtWktXuanuHSX.cs	High entropy of concatenated method names: 'BLM3rzpZtmjMMu9ZsUHeoVBJXmNvFTRdmUqRb7gYZvnQ023Cc', 'nh3KsCg04VCVMQzVX4yaL58h78ZCZR8yeuPao0ZRQAzQQfuhq', 'NSMkFOzg0rZ6YqpPV3jZhKbGaQFdPWF29l6I6P5YFrOgeKbV8', 'qs9Wu1E0FPVMQycOn1HJaAUJedRWZGda7UWzDgSkpWktqMZgy', 'QGfHhiirzqTpJFc5NkDUvgJg31bxC7yQtXexVJne2avAwOXKL', 'srbGpOt4IdjtvS1TwXRlvnc4c4gMPvIdCsO2p4tYzwPFtKHXP', '_3R8LTyvp37xGDVBNwmZfDvT0LDKI8CQ47hU8sbKhfmLlIZKVY', 'KrQ81CshIb95AY55FoK2Ee1LRHguA1kYew6tgd9j5l5CANh0s', '_80T3zQuCLmB5ehw5g8EaUt5gzDf0cydzCZVGIXQu9VyAEKVE0', 'lwJG5dNm7w2PzL4a9SPA0hMi69md5pEaJwj1OuoGCf6fCECxc'
Source: DriverUpdt.0.dr, 2uBhJ8fSv8l0pNFJnFq2SeR3AXe9pdtb8Z.cs	High entropy of concatenated method names: 'Mdt9l9R8TF7ur7Pv30sF3z8cCt5ncWgSUS', '_70nnctB0EBs6NssjjTsDMAAfcZ4iiAEHaKkdAz63u5sgFONvGoKYnEmvZ5kohXRXUz207sWNz3P5dlDx9Qoo', 'olVlEttCG0PtcKVJ8QXyt4BxeUf13GiNneDO1Ctkq1AIuJ4jSloNmWQLAFcjbp6aLg3WjEOqU8zoAegrngbA', 'wrAbldAE7kHEx7Kx4FEe3dRz4nBQPFr3j0wvR6guJ9wnN4TTAfdOIU7cMx35Pohmhy8fRwMzE86QOEJ0V5ax', 'FXknOpZ2o73XPQpP4mWAElExaLv4JJSMQlVlXT1MA9uK3rCo7i2DNomtuzlFOQCjOIXboCjQ1fNpJeyi5KAF'
Source: DriverUpdt.0.dr, e95G2DjFXzv6C0eArUQts1cNIeQlL39BGnN7z8xoz5lRERj07.cs	High entropy of concatenated method names: 'ikzeM2JjEiTZLrO4eUCXFnU3WhiotWH5eWDkWpRierwdr2jWl', 'YsZjJgGxZhrccUsYXC98oaLNoqPds9pMA56yCOIGchvARkPK3', '_9qYRdciTZi8i7BmpK0OOQJbLuUfk0z6ikVdYd1DyqBjlzB5Vx', 'xjT7ceg8SwwL3sI8Prh56VIZ0ES3HiNdmbcU8Cm75DFqlG2OS', 'ttlJyRRizCsAKjUHv21YMfaAgQrItnUt936IpaaS0IWCuuL79', '_7lBB1vY9590PUwREPO2XQ9Ta2N4rUi5ZXMjenqB87tjDhYrpf', 'Gv9IXoYTxUOMuYnNNc8bmf2rD4vZWhXeT8NBsI5cfmsvPkd9T', 'yBGjAMx4IrJ4aBRYYrLAGIaGfZ84WjDxBONjZCVTj7f3O6dzv', 'Inhu2x7FoMBVe9FuhOGNS6bRyCxJrr4oKyVkAtDg2IcXXlICq', 'Vb2OtZ2mFtvBXdxk6W24bVlMj4TR0t2hjt8ZveELUelgwbLWo'
Source: DriverUpdt.0.dr, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	High entropy of concatenated method names: 'ildmhkmnbomr0mhRclue73B4mqDqfe2JCONbWZi8jSg3MtK5L', 'nVAtaQnZ6l6nBm3lJhzBnKxeTFQmUXn7zcx5uYC0wgSdqcy9h', 'eBRTBiiKlaBa0nndhupVEfasKgyUQgsIYVjXrOAxWRHbx97Yy', 'xDDAcd24X0UM0InsZAzkXyNlZC0y1oxxZs08YSlDl5W7voDP9', '_9x3bq69WpSh2QEbPgy13f3Thf8mb07YJXQtTgORxCaKVouQ7r', 'DRBpVHXHuIDdraLjtTW3ud5dBP9RMkpv0ICIvukFEz8OdD914', 'Cm1g9Xqe6mvRnFJHFdCeAoPaFcp8RFYtH4OyMNAh2ZrNktAKB', 'zycGKiBG1PdklsIFy5rda165WUVvnKSgGnjiWxqJMhFCyfF6L', 'lLd9DKzpQ9cOwBL2Cqz03ESn4JJdLZlGGegBMZAEgRLcpbTLz', 'qEejvT4kIexfScEWiaTm5ayBpThzE6FSO130Sq9CSehtYMKy0'
Source: DriverUpdt.0.dr, NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.cs	High entropy of concatenated method names: 'j70LpoWliDlcDxqBLr7QPUVmRwzEZZSB5Q', 'XjyxFp9w2yxFP7yagokte9Txm6vSpEwZvu', 'xsIANs6XzK9V9g4bVJ7oYf2yaC2F6Zdoui', 'SCYpS2v9ZMrHbvPKUkLCFTdqvJwrWL6UIq', 'Gn3LPYcAEH4fT4FDq0lYO2pqy1ZyTAMzHJ', 'wqOdlSLJYxuGSGNkBiX4qpJaeYvgLOEtyT', 'YPaFf6ag4KSOtFiZYcsP8kSHEABZbUeg0Y', 'W5kNoQ1Lru1E9kA2mBElGDjEiNqtw2kYzY', 'Fg7NzeJUpyCxTbjekUC33MYJZYr1kYncAM', 'JPViTqXldagtsTNADEBTIiJu1dzXJmcJ3g'
Source: DriverUpdt.0.dr, wOOq5bB92Ba7ooz2WkCQzTmIBUxVaDWziB.cs	High entropy of concatenated method names: 'R4qUnPzsX0NNtkNpbJLbOefCNgIn8Khuyn', 'wJMZ8oQvfLskpob9at41iUQcenI8WcFxS1', 'JDj0bhNXMA4oVfZMP8tr1xDpOnCEknUWCj', 'VSLvHoxKCl8UT61ZJzsYVNx0hIvaK5Draj', '_88qow1UlAh03CWPLgNcWynEtzl', 'clcGaDtaQDW3m5zqoXpsOYFE0S', '_652Oz4ZQx0IEy53L0DdCU8bVhA', 'MV4RQrPbq6IgaySoRPKtxrBaex', 'TDpTfW2S1YbyGXkCojqO0lNSsq', 'joZe4kEAR1UlntbknsLA6l9pCX'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, 0f5wN5iaksWJx8oMfJnXxCNtYs1IH8rt9K.cs	High entropy of concatenated method names: 'opDBjU1PODJbkaegdOB16WOFLY3mQwEdEl', 'a8JZBv7fLLr1RdVHhT7X73eC6HVDEuyzz5', '_0b9JnZEwICj7AGlBNURRztqML9SXeOZXL7', 'ATm6kN4FZHBZVfWhdbiVl10mjT', 'VD7JRi8WA6tNsZYOCrtsYfuvZV', '_55RVfoVYvecnmerTVPbxQt16vz', 'fW22Fiwx3IERa8JUW4qOSSwnFO', 'QPB9P6GSY9LK8xuIoVRml4j6MF', 'gzqTCi4f8OAhTPJItNGigaUu0T', 'XpA5SrtJGG2wBuUMwtKaY0RP2E'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, ZNHrNvFD9ZobwV38ubTReWLeO8bnAumccihqlfuYjWyldAumT.cs	High entropy of concatenated method names: 'avahQgg4hRxzX9sWEUVQHLXmMpxnnFQiZAhATcEne8jNC3GaHS6apCiUPFDRZ2tiMU', 'iiFlDfMB5MyGNa4QvvKZTieUzrznlepuhAftVwpjHqQyaIbiUMOa0yDQeLU5ZDvfvt', 'jSKnBOXrdi9UB1TQioMoUO8q6XAJicBEgFkb8UwhJy2Q2On2QORUreQXzhgeuvAnUh', 'MUGBiOpCAZALg18jYxbZem3mEJnIrJwCh5qELe8nZUzaT18guOceKdRTXNILt3qGh4'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, ItGbRSbZFa55CcXB.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', '_0Love8mNF6aQdUOwBy38dDjl1YTHDjVbSbOLcprgBKwiaR9GQJqhsr24QGQFBc7oR5', '_5CSekGcVzZeoXZVENEqxcwNMvwPPZKiVqsUftGWbLqoK0sGqe9F3gVvJh1EQlCCqY4', 'Ht267XslWyBGNwGKM8CnIlTTlhouBGyJmbW8Udltu3AppwidYGJJMEneGlGyg7L0u0', 'KWl0mfZs0Dl0gfgooBpj0tseVrhreDSUzs9bW3ppX0z5NFwdu7aM7NIm4QF3v9wRy3'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, Rh46SGTJYh5nC7MsPl2FieEVPZw16o7SqK.cs	High entropy of concatenated method names: 'APq8HycpkPPjuDvi1sU0rjrQUmaVP3ID5K', 'UAc4yzzQ0GHVyuqxYwn0WWNqNW5YVXEX1T', '_7GJx3tULSMI6DNglNBPRFZnT7FpG6XxC24', 'oNjeO3ZFk0i7KeWtYzLT6DEYzx5EIl1Skx', 'Hivj6AHvQE9Mw9dvVggOg6jXbqNcPsJN8t', 'suBZaleEhn3iSaelJmGDY5DltNl5Tewq00', 'VDkCCL325lQjGKNJKk7TBL2Udz2oezOxb9', '_0YZbHdatVdNEN8nbiS8yT54eVWO30E8DWa', 'lp9NjEbIPxs9pF55qE3jVLzvblspVcvmaH', 'UhWxUNDlFThOwjYPG0l0acHFr5NePqj52e'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, IxmT2WkPyORcZnISbnQeQ4J3xaAS3FBXxGK6ZtWktXuanuHSX.cs	High entropy of concatenated method names: 'BLM3rzpZtmjMMu9ZsUHeoVBJXmNvFTRdmUqRb7gYZvnQ023Cc', 'nh3KsCg04VCVMQzVX4yaL58h78ZCZR8yeuPao0ZRQAzQQfuhq', 'NSMkFOzg0rZ6YqpPV3jZhKbGaQFdPWF29l6I6P5YFrOgeKbV8', 'qs9Wu1E0FPVMQycOn1HJaAUJedRWZGda7UWzDgSkpWktqMZgy', 'QGfHhiirzqTpJFc5NkDUvgJg31bxC7yQtXexVJne2avAwOXKL', 'srbGpOt4IdjtvS1TwXRlvnc4c4gMPvIdCsO2p4tYzwPFtKHXP', '_3R8LTyvp37xGDVBNwmZfDvT0LDKI8CQ47hU8sbKhfmLlIZKVY', 'KrQ81CshIb95AY55FoK2Ee1LRHguA1kYew6tgd9j5l5CANh0s', '_80T3zQuCLmB5ehw5g8EaUt5gzDf0cydzCZVGIXQu9VyAEKVE0', 'lwJG5dNm7w2PzL4a9SPA0hMi69md5pEaJwj1OuoGCf6fCECxc'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, 2uBhJ8fSv8l0pNFJnFq2SeR3AXe9pdtb8Z.cs	High entropy of concatenated method names: 'Mdt9l9R8TF7ur7Pv30sF3z8cCt5ncWgSUS', '_70nnctB0EBs6NssjjTsDMAAfcZ4iiAEHaKkdAz63u5sgFONvGoKYnEmvZ5kohXRXUz207sWNz3P5dlDx9Qoo', 'olVlEttCG0PtcKVJ8QXyt4BxeUf13GiNneDO1Ctkq1AIuJ4jSloNmWQLAFcjbp6aLg3WjEOqU8zoAegrngbA', 'wrAbldAE7kHEx7Kx4FEe3dRz4nBQPFr3j0wvR6guJ9wnN4TTAfdOIU7cMx35Pohmhy8fRwMzE86QOEJ0V5ax', 'FXknOpZ2o73XPQpP4mWAElExaLv4JJSMQlVlXT1MA9uK3rCo7i2DNomtuzlFOQCjOIXboCjQ1fNpJeyi5KAF'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, e95G2DjFXzv6C0eArUQts1cNIeQlL39BGnN7z8xoz5lRERj07.cs	High entropy of concatenated method names: 'ikzeM2JjEiTZLrO4eUCXFnU3WhiotWH5eWDkWpRierwdr2jWl', 'YsZjJgGxZhrccUsYXC98oaLNoqPds9pMA56yCOIGchvARkPK3', '_9qYRdciTZi8i7BmpK0OOQJbLuUfk0z6ikVdYd1DyqBjlzB5Vx', 'xjT7ceg8SwwL3sI8Prh56VIZ0ES3HiNdmbcU8Cm75DFqlG2OS', 'ttlJyRRizCsAKjUHv21YMfaAgQrItnUt936IpaaS0IWCuuL79', '_7lBB1vY9590PUwREPO2XQ9Ta2N4rUi5ZXMjenqB87tjDhYrpf', 'Gv9IXoYTxUOMuYnNNc8bmf2rD4vZWhXeT8NBsI5cfmsvPkd9T', 'yBGjAMx4IrJ4aBRYYrLAGIaGfZ84WjDxBONjZCVTj7f3O6dzv', 'Inhu2x7FoMBVe9FuhOGNS6bRyCxJrr4oKyVkAtDg2IcXXlICq', 'Vb2OtZ2mFtvBXdxk6W24bVlMj4TR0t2hjt8ZveELUelgwbLWo'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, cAzqzAvd3bxf9n3F3HaWLzB2xJOXRxGRVOHOGdKnuAZ66nxtm.cs	High entropy of concatenated method names: 'ildmhkmnbomr0mhRclue73B4mqDqfe2JCONbWZi8jSg3MtK5L', 'nVAtaQnZ6l6nBm3lJhzBnKxeTFQmUXn7zcx5uYC0wgSdqcy9h', 'eBRTBiiKlaBa0nndhupVEfasKgyUQgsIYVjXrOAxWRHbx97Yy', 'xDDAcd24X0UM0InsZAzkXyNlZC0y1oxxZs08YSlDl5W7voDP9', '_9x3bq69WpSh2QEbPgy13f3Thf8mb07YJXQtTgORxCaKVouQ7r', 'DRBpVHXHuIDdraLjtTW3ud5dBP9RMkpv0ICIvukFEz8OdD914', 'Cm1g9Xqe6mvRnFJHFdCeAoPaFcp8RFYtH4OyMNAh2ZrNktAKB', 'zycGKiBG1PdklsIFy5rda165WUVvnKSgGnjiWxqJMhFCyfF6L', 'lLd9DKzpQ9cOwBL2Cqz03ESn4JJdLZlGGegBMZAEgRLcpbTLz', 'qEejvT4kIexfScEWiaTm5ayBpThzE6FSO130Sq9CSehtYMKy0'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, NV31X1ToxhOFhVuWPZSu670P9wPGjQJEsv.cs	High entropy of concatenated method names: 'j70LpoWliDlcDxqBLr7QPUVmRwzEZZSB5Q', 'XjyxFp9w2yxFP7yagokte9Txm6vSpEwZvu', 'xsIANs6XzK9V9g4bVJ7oYf2yaC2F6Zdoui', 'SCYpS2v9ZMrHbvPKUkLCFTdqvJwrWL6UIq', 'Gn3LPYcAEH4fT4FDq0lYO2pqy1ZyTAMzHJ', 'wqOdlSLJYxuGSGNkBiX4qpJaeYvgLOEtyT', 'YPaFf6ag4KSOtFiZYcsP8kSHEABZbUeg0Y', 'W5kNoQ1Lru1E9kA2mBElGDjEiNqtw2kYzY', 'Fg7NzeJUpyCxTbjekUC33MYJZYr1kYncAM', 'JPViTqXldagtsTNADEBTIiJu1dzXJmcJ3g'
Source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, wOOq5bB92Ba7ooz2WkCQzTmIBUxVaDWziB.cs	High entropy of concatenated method names: 'R4qUnPzsX0NNtkNpbJLbOefCNgIn8Khuyn', 'wJMZ8oQvfLskpob9at41iUQcenI8WcFxS1', 'JDj0bhNXMA4oVfZMP8tr1xDpOnCEknUWCj', 'VSLvHoxKCl8UT61ZJzsYVNx0hIvaK5Draj', '_88qow1UlAh03CWPLgNcWynEtzl', 'clcGaDtaQDW3m5zqoXpsOYFE0S', '_652Oz4ZQx0IEy53L0DdCU8bVhA', 'MV4RQrPbq6IgaySoRPKtxrBaex', 'TDpTfW2S1YbyGXkCojqO0lNSsq', 'joZe4kEAR1UlntbknsLA6l9pCX'

Source: C:\Users\user\Desktop\DriverUpdt.exe

File created: C:\Users\user\AppData\Roaming\DriverUpdt

Jump to dropped file

Source: C:\Users\user\Desktop\DriverUpdt.exe

File created: C:\Users\user\AppData\Roaming\DriverUpdt

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\DriverUpdt.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DriverUpdt" /tr "C:\Users\user\AppData\Roaming\DriverUpdt"

Source: C:\Users\user\Desktop\DriverUpdt.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DriverUpdt.lnk

Source: C:\Users\user\Desktop\DriverUpdt.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DriverUpdt.lnk

Loading BitLocker PowerShell Module

Source: C:\Users\user\Desktop\DriverUpdt.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DriverUpdt			Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DriverUpdt			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: DriverUpdt.exe, DriverUpdt.0.dr

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\DriverUpdt.exe	Memory allocated: 1350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Memory allocated: 1AFE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Memory allocated: A10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Memory allocated: 1A570000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Memory allocated: 1090000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Memory allocated: 1AB30000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\DriverUpdt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\DriverUpdt.exe	Window / User API: threadDelayed 9392	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Window / User API: threadDelayed 448	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5557	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4271	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7311	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2296	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6006	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3616	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6616
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3117

Source: C:\Users\user\Desktop\DriverUpdt.exe TID: 7080	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3936	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1680	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7044	Thread sleep count: 6006 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7044	Thread sleep count: 3616 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1076	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5228	Thread sleep count: 6616 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2968	Thread sleep count: 3117 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3836	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Users\user\AppData\Roaming\DriverUpdt TID: 5948	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1964	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\DriverUpdt TID: 2576	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Desktop\DriverUpdt.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\DriverUpdt	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\DriverUpdt	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\DriverUpdt.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Thread delayed: delay time: 922337203685477

Source: DriverUpdt.0.dr	Binary or memory string: vmware
Source: svchost.exe, 00000012.00000002.3277939813.000001BA75A54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.3277339892.000001BA75A42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.3273129280.000001BA7042B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DriverUpdt.exe, 00000000.00000002.3313153105.000000001BEA2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\DriverUpdt.exe

Process information queried: ProcessInformation

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Anti Debugging

Source: C:\Users\user\Desktop\DriverUpdt.exe

Code function: 0_2_00007FF848F0764A CheckRemoteDebuggerPresent,

0_2_00007FF848F0764A

Source: C:\Users\user\Desktop\DriverUpdt.exe

Process queried: DebugPort

Source: C:\Users\user\Desktop\DriverUpdt.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Process token adjusted: Debug

Source: C:\Users\user\Desktop\DriverUpdt.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\DriverUpdt.exe'
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\DriverUpdt'
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\DriverUpdt.exe'	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\DriverUpdt'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\Desktop\DriverUpdt.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\DriverUpdt.exe'

Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\DriverUpdt.exe'	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DriverUpdt.exe'	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\DriverUpdt'	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DriverUpdt'	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DriverUpdt" /tr "C:\Users\user\AppData\Roaming\DriverUpdt"	Jump to behavior

Source: C:\Users\user\Desktop\DriverUpdt.exe	Queries volume information: C:\Users\user\Desktop\DriverUpdt.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DriverUpdt.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Queries volume information: C:\Users\user\AppData\Roaming\DriverUpdt VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\DriverUpdt	Queries volume information: C:\Users\user\AppData\Roaming\DriverUpdt VolumeInformation

Source: C:\Users\user\Desktop\DriverUpdt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: DriverUpdt.exe, 00000000.00000002.3313153105.000000001BEA2000.00000004.00000020.00020000.00000000.sdmp, DriverUpdt.exe, 00000000.00000002.3313153105.000000001BEEC000.00000004.00000020.00020000.00000000.sdmp, DriverUpdt.exe, 00000000.00000002.3313153105.000000001BF04000.00000004.00000020.00020000.00000000.sdmp, DriverUpdt.exe, 00000000.00000002.3313153105.000000001BF3F000.00000004.00000020.00020000.00000000.sdmp, DriverUpdt.exe, 00000000.00000002.3272706936.0000000001415000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\DriverUpdt.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: DriverUpdt.exe, type: SAMPLE
Source: Yara match	File source: 0.0.DriverUpdt.exe.df0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DriverUpdt.exe.12ff1a78.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3310295199.0000000012FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2026730895.0000000000DF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3278221040.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DriverUpdt.exe PID: 5520, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\DriverUpdt, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: DriverUpdt.exe, type: SAMPLE
Source: Yara match	File source: 0.0.DriverUpdt.exe.df0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DriverUpdt.exe.12ff1a78.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DriverUpdt.exe.12ff1a78.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3310295199.0000000012FF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2026730895.0000000000DF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3278221040.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DriverUpdt.exe PID: 5520, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\DriverUpdt, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	21 Masquerading	OS Credential Dumping	551 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 DLL Side-Loading	21 Registry Run Keys / Startup Folder	161 Virtualization/Sandbox Evasion	Security Account Manager	161 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
DriverUpdt.exe	84%	ReversingLabs	ByteCode-MSIL.Trojan.AsyncRAT
DriverUpdt.exe	100%	Avira	TR/Spy.Gen
DriverUpdt.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\DriverUpdt	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\DriverUpdt	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\DriverUpdt	84%	ReversingLabs	ByteCode-MSIL.Trojan.AsyncRAT

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
https://ion=v4.5mConsumererv	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/Prod/C:	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/ProdV2.C:	0%	Avira URL Cloud	safe
http://crl.microsp	0%	Avira URL Cloud	safe
http://crl.mic	0%	Avira URL Cloud	safe
http://www.microsoom/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l	0%	Avira URL Cloud	safe
http://crl.micft.cMicRosof	0%	Avira URL Cloud	safe
http://crl.m	0%	Avira URL Cloud	safe
http://crl.micros	0%	Avira URL Cloud	safe
stewiegriffin-37537.portmap.host	100%	Avira URL Cloud	malware
http://www.microsoft.c	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	true		unknown
stewiegriffin-37537.portmap.host	193.161.193.99	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
stewiegriffin-37537.portmap.host	true	Avira URL Cloud: malware	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2119512647.0000029C6C39F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2209288191.00000135D96FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2359742614.0000019A7675F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2552881667.0000014E3077E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.2418918680.0000014E2093A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.2102983893.0000029C5C558000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2153166994.00000135C98B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2265756719.0000019A66AA2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2418918680.0000014E2093A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.2418918680.0000014E2093A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 0000000A.00000002.2552881667.0000014E3077E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.mic	powershell.exe, 00000005.00000002.2227719144.00000135E1DF5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2586638323.0000014E39008000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.2552881667.0000014E3077E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000012.00000002.3276702426.000001BA75A0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000012.00000003.2732456791.000001BA75820000.00000004.00000800.00020000.00000000.sdmp, edb.log.18.dr, qmgr.db.18.dr	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.2418918680.0000014E2093A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.18.dr, qmgr.db.18.dr	false	Avira URL Cloud: safe	unknown
http://crl.m	powershell.exe, 0000000A.00000002.2586638323.0000014E39008000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoom/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l	powershell.exe, 0000000A.00000002.2586638323.0000014E39008000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ion=v4.5mConsumererv	powershell.exe, 00000002.00000002.2127592677.0000029C74A39000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsp	powershell.exe, 0000000A.00000002.2583865294.0000014E38E00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.2102983893.0000029C5C558000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2153166994.00000135C98B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2265756719.0000019A66AA2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2418918680.0000014E2093A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 0000000A.00000002.2552881667.0000014E3077E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2119512647.0000029C6C39F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2209288191.00000135D96FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2359742614.0000019A7675F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2552881667.0000014E3077E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.micft.cMicRosof	powershell.exe, 00000005.00000002.2227719144.00000135E1DF5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2586638323.0000014E39008000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2102983893.0000029C5C331000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2153166994.00000135C9691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2265756719.0000019A666F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2418918680.0000014E20711000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.microsoft.c	powershell.exe, 00000008.00000002.2385082051.0000019A7EEF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DriverUpdt.exe, 00000000.00000002.3278221040.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2102983893.0000029C5C331000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2153166994.00000135C9691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2265756719.0000019A666F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2418918680.0000014E20711000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.micros	powershell.exe, 00000005.00000002.2225891671.00000135E1C30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	true
193.161.193.99	stewiegriffin-37537.portmap.host	Russian Federation		198134	BITREE-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465719
Start date and time:	2024-07-02 00:32:53 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DriverUpdt.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@21/25@2/3
EGA Information:	Successful, ratio: 14.3%
HCA Information:	Successful, ratio: 95% Number of executed functions: 76 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target DriverUpdt, PID 3008 because it is empty
Execution Graph export aborted for target DriverUpdt, PID 4768 because it is empty
Execution Graph export aborted for target powershell.exe, PID 348 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3924 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5388 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7084 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: DriverUpdt.exe

Simulations

Behavior and APIs

Time	Type	Description
00:34:41	Task Scheduler	Run new task: DriverUpdt path: C:\Users\user\AppData\Roaming\DriverUpdt
00:34:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run DriverUpdt C:\Users\user\AppData\Roaming\DriverUpdt
00:34:51	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run DriverUpdt C:\Users\user\AppData\Roaming\DriverUpdt
00:34:59	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DriverUpdt.lnk
18:33:46	API Interceptor	54x Sleep call for process: powershell.exe modified
18:34:44	API Interceptor	117106x Sleep call for process: DriverUpdt.exe modified
18:34:51	API Interceptor	2x Sleep call for process: svchost.exe modified
18:34:51	API Interceptor	2x Sleep call for process: OpenWith.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	rinvoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	rQuotation.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	8f5WsFcnTc.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	ZkqNrYh5cV.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	rQoutation.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	v31TgVEtHi.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	yVtOz1fD5G.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	8w5wHh755H.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	001 Tech. Spec pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	doc -scan file.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
193.161.193.99	Yq5Gp2g2vB.exe	Get hash	malicious	RedLine	Browse	okmaq-24505.portmap.host:24505/
	JnBNepHH7K.exe	Get hash	malicious	AsyncRAT RedLine	Browse	exara32-64703.portmap.host:64703/
	99SKW728vf.exe	Get hash	malicious	RedLine	Browse	lottie9nwtina-55339.portmap.host:55339/
	amazoninvoiceAF0388d83739dee83479171dbcf.exe	Get hash	malicious	RedLine	Browse	tete2792-22120.portmap.host:22120//

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	rinvoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	rQuotation.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8f5WsFcnTc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ZkqNrYh5cV.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rQoutation.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	v31TgVEtHi.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	yVtOz1fD5G.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8w5wHh755H.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	001 Tech. Spec pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	doc -scan file.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITREE-ASRU	password.exe	Get hash	malicious	SugarDump, XWorm	Browse	193.161.193.99
	Project Al Ain (Hilli & Al Fou#U2019ah) Parks.vbe	Get hash	malicious	StormKitty, XWorm	Browse	193.161.193.99
	9Ok3QP5FFV.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	193.161.193.99
	Client.exe	Get hash	malicious	Quasar	Browse	193.161.193.99
	siuu.exe	Get hash	malicious	XWorm	Browse	193.161.193.99
	y0w04xGM45.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	193.161.193.99
	Se7CZnlXZZ.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	193.161.193.99
	fP4kybhBWi.exe	Get hash	malicious	Quasar	Browse	193.161.193.99
	zTuiDLpfjZ.exe	Get hash	malicious	Quasar	Browse	193.161.193.99
	bUmi.exe	Get hash	malicious	Njrat	Browse	193.161.193.99
TUT-ASUS	rinvoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	rQuotation.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8f5WsFcnTc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ZkqNrYh5cV.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rQoutation.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	v31TgVEtHi.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	yVtOz1fD5G.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8w5wHh755H.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	001 Tech. Spec pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	doc -scan file.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307301594197765
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugZ:gJjJGtpTq2yv1AuNZRY3diu8iBVqFz
MD5:	37EA4D4C095492AB5D976770EED6337E
SHA1:	E30445DA165D07A0143C9F655CE92E1A39BFE94A
SHA-256:	80DEBE333007A8E504D902BF9D0DD56C23EED5FE1896A70241530D8D0CEFEE8A
SHA-512:	38774B18427E1F9CDA4CFFF52C7AF47EBBD1B10FE57898BFA028DC55F6FF88D4C053747856552A585C200636F02953FF455C8C3A5D3456720494E280A1A40981
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7693279d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6586182627060748
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:5aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	440120B60582CFACAF0BD49823FF4094
SHA1:	10332A44BCBB3CA8D019A3110F79CCF88F83A49A
SHA-256:	5209D5563A272C96AA4580DDCCC38581D30AC2203D1EB85DBAFEAF1A250DC8E7
SHA-512:	42915A9B8F43EC1EB51D58EB7E313728ACBF5A84CAA416397ADFBC73E5345345C761881950CD8C176A9480C0A616E9BB4ABF702FD11F2F110BBF5D9469DDF396
Malicious:	false
Preview:	v.'.... ...............X\...;...{......................0.z..........{..3"...\|y.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{.....................................3"...\|..................}...3"...\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08124453285313288
Encrypted:	false
SSDEEP:	3:XXEYehoiZ4wulekGuAJkhvekl19CllYllrekGltll/SPj:XXEzhoztrxlLmeJe3l
MD5:	29454DA74EDCF276550237745DAF0477
SHA1:	A3DA122C6DD000BE16A309F6952C6A6292F99FF7
SHA-256:	4C174535E64691CBF8F73DC8BBDF952FA9C4215512CF5B18F318AFE95D4935E1
SHA-512:	CBC54BFDA1506E46A14214EE1ADE8EF30CD67C5D0BEA8C1450FDD2D3147B90C4DB768FB2BA72F35CB96E962C8F3BDE7D1524D5580DDC827FB4D1F858AB4BF0A9
Malicious:	false
Preview:	.{!i.....................................;...{..3"...\|.......{...............{.......{...XL......{..................}...3"...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DriverUpdt.log

Process:	C:\Users\user\AppData\Roaming\DriverUpdt
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\Log.tmp

Process:	C:\Users\user\Desktop\DriverUpdt.exe
File Type:	Generic INItialization configuration [WIN]
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.6722687970803873
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr42VjFYJKXzovuEXn:EFYJKDoWr5FYJKDoG+n
MD5:	DE63D53293EBACE29F3F54832D739D40
SHA1:	1BC3FEF699C3C2BB7B9A9D63C7E60381263EDA7F
SHA-256:	A86BA2FC02725E4D97799A622EB68BF2FCC6167D439484624FA2666468BBFB1B
SHA-512:	10AB83C81F572DBAA99441D2BFD8EC5FF1C4BA84256ACDBD24FEB30A33498B689713EBF767500DAAAD6D188A3B9DC970CF858A6896F4381CEAC1F6A74E1603D0
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]....### explorer ###..r[WIN]r

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_02jsdgny.q2t.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_12zc25uq.q0f.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1vnoaoms.u4z.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4jl1nfem.5qp.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_emyiijh0.i5e.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ikfhwfho.3vz.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iqud4z3t.4pq.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jh2xp0ln.q4v.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lszxbovc.ozj.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rjisagsy.crl.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sl32vdvz.p3a.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t4c410in.jwt.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tzsdp5rh.00h.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u3f3g5r3.poz.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vknoxv4m.pv1.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yzycsrnx.ae2.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\DriverUpdt

Process:	C:\Users\user\Desktop\DriverUpdt.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	86528
Entropy (8bit):	5.924066251460331
Encrypted:	false
SSDEEP:	1536:hZN9jYzwjg6XJlg1cpGxCgN6Fg94b6lFsmqsb7FHxQ6w3k08Bn6ZKsGOPVtrhID:hDJFjP3gOKLN6Frb6lEcRx30MlOPVFGD
MD5:	65485B0475B6C8A3B4F35BBA541938A6
SHA1:	28E6E6CD2EBF8A9FDFFEB4AEBA13B70EA7EA03A3
SHA-256:	C6740EE5C8AFDC2C7BE42FB03AB5A346925EFC6AC785FE7D68DEC2D5F05D276B
SHA-512:	034303EE48132B80DA79E54A6077676CFD436EF869493A11A27C29DC7CB730FD2CE902320D554A0CDE81FC0A06F6C56EFA5C170A1360906EC9FA7FD101C3706D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\DriverUpdt, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\DriverUpdt, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\DriverUpdt, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Rwf.................H..........^g... ........@.. ....................................@..................................g..O.................................................................................... ............... ..H............text...dG... ...H.................. ..`.rsrc................J..............@..@.reloc...............P..............@..B................@g......H........d..........&.....................................................(.....r...p. ..d...(.....rG..p. .b...s.........s.........s.........s..........r...p. .l...rU..p. .....r...p. 3wx..rc..p. .....r...p. z.6...((....r...p. j....r...p. .q...(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(Z..."(....+.&(....&+..+5sk... .... .'..ol...(,...~....-.(_...(Q...~....om...&.-..r...p. "Y...r5..p. ....r...p. ..e..r...p. .O...r...p. S....rQ..p. .t..*.r..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DriverUpdt.lnk

Process:	C:\Users\user\Desktop\DriverUpdt.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Mon Jul 1 21:34:39 2024, mtime=Mon Jul 1 21:34:39 2024, atime=Mon Jul 1 21:34:39 2024, length=86528, window=hide
Category:	dropped
Size (bytes):	758
Entropy (8bit):	5.027512260081178
Encrypted:	false
SSDEEP:	12:8t64f3xy88Cv7lsY//3kJLaTrGKA/zjAshcFHpRCqLGAnmV:81fBp8Q7Z8FcB0AshclC8GAnm
MD5:	B28360C3527ACFAE4AFAF4F032A823C1
SHA1:	ACADBD3FD5486B0877514B229D0A6E50BE97D46B
SHA-256:	35149B831F74E6ACC19D3F820A24D65364AED40C0A260E04EA80DF0A3DCAD264
SHA-512:	37E4B04D1CD6E649A07F293312872158FE4DDE3A97C69A16B90396D5E226CA536A4EA2D300712EC96D6224A58BF4774A84B74C94F39C77FACA0627321AE2CC06
Malicious:	false
Preview:	L..................F.... ...a.K.....a.K.....a.K......R......................r.:..DG..Yr?.D..U..k0.&...&...... M......._.......`.........t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.X4.....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......X2...Roaming.@......DWSl.X2.....C........................R.o.a.m.i.n.g.....^.2..R...XT. .DRIVER~1..F.......XT..XT...../......................}..D.r.i.v.e.r.U.p.d.t.......Y...............-.......X............Fca.....C:\Users\user\AppData\Roaming\DriverUpdt........\.....\.....\.....\.....\.D.r.i.v.e.r.U.p.d.t.`.......X.......980108...........hT..CrF.f4... .z.V..7...,...W..hT..CrF.f4... .z.V..7...,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.924066251460331
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	DriverUpdt.exe
File size:	86'528 bytes
MD5:	65485b0475b6c8a3b4f35bba541938a6
SHA1:	28e6e6cd2ebf8a9fdffeb4aeba13b70ea7ea03a3
SHA256:	c6740ee5c8afdc2c7be42fb03ab5a346925efc6ac785fe7d68dec2d5f05d276b
SHA512:	034303ee48132b80da79e54a6077676cfd436ef869493a11a27c29dc7cb730fd2ce902320d554a0cde81fc0a06f6c56efa5c170a1360906ec9fa7fd101c3706d
SSDEEP:	1536:hZN9jYzwjg6XJlg1cpGxCgN6Fg94b6lFsmqsb7FHxQ6w3k08Bn6ZKsGOPVtrhID:hDJFjP3gOKLN6Frb6lEcRx30MlOPVFGD
TLSH:	8E836C283BEA4029F1FFAFB559F03553CA79F7236903965F24C1024A4B13A89CE516F9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Rwf.................H..........^g... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41675e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6677528D [Sat Jun 22 22:39:09 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1670c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x14764	0x14800	fe1fb6b6ebc82d471d994033bc77f929	False	0.6055163871951219	data	5.98433140864096	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x18000	0x4de	0x600	e3575bc3f61464e22b07945e182ef084	False	0.376953125	data	3.7515270043715	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	ca717e9c532730ff63d09608f29eb26a	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x180a0	0x254	data			0.4664429530201342
RT_MANIFEST	0x182f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 00:33:46.197632074 CEST	49704	80	192.168.2.5	208.95.112.1
Jul 2, 2024 00:33:46.204066992 CEST	80	49704	208.95.112.1	192.168.2.5
Jul 2, 2024 00:33:46.204144001 CEST	49704	80	192.168.2.5	208.95.112.1
Jul 2, 2024 00:33:46.205002069 CEST	49704	80	192.168.2.5	208.95.112.1
Jul 2, 2024 00:33:46.214745045 CEST	80	49704	208.95.112.1	192.168.2.5
Jul 2, 2024 00:33:46.707642078 CEST	80	49704	208.95.112.1	192.168.2.5
Jul 2, 2024 00:33:46.754005909 CEST	49704	80	192.168.2.5	208.95.112.1
Jul 2, 2024 00:34:33.014759064 CEST	80	49704	208.95.112.1	192.168.2.5
Jul 2, 2024 00:34:33.014827967 CEST	49704	80	192.168.2.5	208.95.112.1
Jul 2, 2024 00:34:45.773448944 CEST	49714	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:45.784511089 CEST	37537	49714	193.161.193.99	192.168.2.5
Jul 2, 2024 00:34:45.784588099 CEST	49714	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:45.846585035 CEST	49714	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:45.851510048 CEST	37537	49714	193.161.193.99	192.168.2.5
Jul 2, 2024 00:34:47.535904884 CEST	37537	49714	193.161.193.99	192.168.2.5
Jul 2, 2024 00:34:47.538517952 CEST	49714	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:50.535537004 CEST	49714	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:50.536799908 CEST	49715	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:50.847866058 CEST	49714	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:51.457243919 CEST	49714	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:51.508445978 CEST	37537	49714	193.161.193.99	192.168.2.5
Jul 2, 2024 00:34:51.508459091 CEST	37537	49715	193.161.193.99	192.168.2.5
Jul 2, 2024 00:34:51.508466959 CEST	37537	49714	193.161.193.99	192.168.2.5
Jul 2, 2024 00:34:51.508644104 CEST	49714	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:51.508645058 CEST	49715	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:51.515245914 CEST	37537	49714	193.161.193.99	192.168.2.5
Jul 2, 2024 00:34:51.515330076 CEST	49714	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:51.524517059 CEST	49715	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:51.539237976 CEST	37537	49715	193.161.193.99	192.168.2.5
Jul 2, 2024 00:34:53.267940044 CEST	37537	49715	193.161.193.99	192.168.2.5
Jul 2, 2024 00:34:53.267997026 CEST	49715	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:56.114512920 CEST	49715	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:56.117841005 CEST	49719	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:56.121367931 CEST	37537	49715	193.161.193.99	192.168.2.5
Jul 2, 2024 00:34:56.124607086 CEST	37537	49719	193.161.193.99	192.168.2.5
Jul 2, 2024 00:34:56.127286911 CEST	49719	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:56.156558990 CEST	49719	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:34:56.163687944 CEST	37537	49719	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:03.269603968 CEST	37537	49719	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:03.270360947 CEST	49719	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:05.176206112 CEST	49719	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:05.178131104 CEST	49722	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:05.182427883 CEST	37537	49719	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:05.184741974 CEST	37537	49722	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:05.184822083 CEST	49722	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:05.203851938 CEST	49722	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:05.210661888 CEST	37537	49722	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:06.923130989 CEST	37537	49722	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:06.923199892 CEST	49722	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:10.254674911 CEST	49722	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:10.257390022 CEST	49723	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:10.260924101 CEST	37537	49722	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:10.263801098 CEST	37537	49723	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:10.263881922 CEST	49723	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:10.320947886 CEST	49723	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:10.327651024 CEST	37537	49723	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:12.043107033 CEST	37537	49723	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:12.043211937 CEST	49723	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:15.848053932 CEST	49723	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:15.849411964 CEST	49724	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:15.854585886 CEST	37537	49723	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:15.855654955 CEST	37537	49724	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:15.855737925 CEST	49724	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:15.874043941 CEST	49724	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:15.880697012 CEST	37537	49724	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:17.595630884 CEST	37537	49724	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:17.595707893 CEST	49724	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:20.301146030 CEST	49724	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:20.303231001 CEST	49725	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:20.307298899 CEST	37537	49724	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:20.309498072 CEST	37537	49725	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:20.309576035 CEST	49725	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:20.324985027 CEST	49725	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:20.331962109 CEST	37537	49725	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:22.098975897 CEST	37537	49725	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:22.099060059 CEST	49725	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:24.863615990 CEST	49725	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:24.864820004 CEST	49726	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:24.870155096 CEST	37537	49725	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:24.871306896 CEST	37537	49726	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:24.871395111 CEST	49726	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:24.886356115 CEST	49726	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:24.893541098 CEST	37537	49726	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:26.645062923 CEST	37537	49726	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:26.648344994 CEST	49726	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:26.740842104 CEST	49704	80	192.168.2.5	208.95.112.1
Jul 2, 2024 00:35:26.745645046 CEST	80	49704	208.95.112.1	192.168.2.5
Jul 2, 2024 00:35:27.301207066 CEST	49726	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:27.302599907 CEST	49727	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:27.306016922 CEST	37537	49726	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:27.308037043 CEST	37537	49727	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:27.308124065 CEST	49727	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:27.324893951 CEST	49727	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:27.329920053 CEST	37537	49727	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:29.054744959 CEST	37537	49727	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:29.054908991 CEST	49727	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:30.441868067 CEST	49727	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:30.443960905 CEST	49728	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:30.448684931 CEST	37537	49727	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:30.451297045 CEST	37537	49728	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:30.451431036 CEST	49728	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:30.475025892 CEST	49728	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:30.482618093 CEST	37537	49728	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:32.255877972 CEST	37537	49728	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:32.256383896 CEST	49728	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:33.067015886 CEST	49728	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:33.068315029 CEST	49729	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:33.073537111 CEST	37537	49728	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:33.075165987 CEST	37537	49729	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:33.075265884 CEST	49729	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:33.092715025 CEST	49729	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:33.099128008 CEST	37537	49729	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:34.876701117 CEST	37537	49729	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:34.879236937 CEST	49729	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:35.457391977 CEST	49729	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:35.459508896 CEST	49730	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:35.462172985 CEST	37537	49729	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:35.464241028 CEST	37537	49730	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:35.464338064 CEST	49730	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:35.481043100 CEST	49730	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:35.485820055 CEST	37537	49730	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:37.240408897 CEST	37537	49730	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:37.240520000 CEST	49730	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:37.316951990 CEST	49730	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:37.318658113 CEST	49731	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:37.323427916 CEST	37537	49730	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:37.325433969 CEST	37537	49731	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:37.325562954 CEST	49731	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:37.342818975 CEST	49731	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:37.350259066 CEST	37537	49731	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:39.065277100 CEST	37537	49731	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:39.065551996 CEST	49731	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:39.618458033 CEST	49731	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:39.620426893 CEST	49732	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:39.625572920 CEST	37537	49731	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:39.627330065 CEST	37537	49732	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:39.627415895 CEST	49732	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:39.643261909 CEST	49732	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:39.650187969 CEST	37537	49732	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:41.362987995 CEST	37537	49732	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:41.364092112 CEST	49732	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:42.176120996 CEST	49732	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:42.177405119 CEST	49733	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:42.183255911 CEST	37537	49732	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:42.184659958 CEST	37537	49733	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:42.184731960 CEST	49733	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:42.199575901 CEST	49733	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:42.207813025 CEST	37537	49733	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:43.946019888 CEST	37537	49733	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:43.946132898 CEST	49733	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:44.421952009 CEST	49733	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:44.428664923 CEST	37537	49733	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:44.440462112 CEST	49734	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:44.447000027 CEST	37537	49734	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:44.447093964 CEST	49734	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:44.463929892 CEST	49734	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:44.470874071 CEST	37537	49734	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:46.237910032 CEST	37537	49734	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:46.238002062 CEST	49734	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:46.446986914 CEST	49734	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:46.451395988 CEST	49735	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:46.452332020 CEST	37537	49734	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:46.457129955 CEST	37537	49735	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:46.457225084 CEST	49735	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:46.517920971 CEST	49735	37537	192.168.2.5	193.161.193.99
Jul 2, 2024 00:35:46.522751093 CEST	37537	49735	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:48.209928989 CEST	37537	49735	193.161.193.99	192.168.2.5
Jul 2, 2024 00:35:48.212846994 CEST	49735	37537	192.168.2.5	193.161.193.99

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 00:33:46.177464962 CEST	50822	53	192.168.2.5	1.1.1.1
Jul 2, 2024 00:33:46.190888882 CEST	53	50822	1.1.1.1	192.168.2.5
Jul 2, 2024 00:34:45.746242046 CEST	58161	53	192.168.2.5	1.1.1.1
Jul 2, 2024 00:34:45.768017054 CEST	53	58161	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 2, 2024 00:33:46.177464962 CEST	192.168.2.5	1.1.1.1	0xc169	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 2, 2024 00:34:45.746242046 CEST	192.168.2.5	1.1.1.1	0xc617	Standard query (0)	stewiegriffin-37537.portmap.host	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 2, 2024 00:33:46.190888882 CEST	1.1.1.1	192.168.2.5	0xc169	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 2, 2024 00:34:45.768017054 CEST	1.1.1.1	192.168.2.5	0xc617	No error (0)	stewiegriffin-37537.portmap.host		193.161.193.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	208.95.112.1	80	5520	C:\Users\user\Desktop\DriverUpdt.exe

Timestamp	Bytes transferred	Direction	Data
Jul 2, 2024 00:33:46.205002069 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 2, 2024 00:33:46.707642078 CEST	175	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 22:33:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	18:33:41
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\DriverUpdt.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\DriverUpdt.exe"
Imagebase:	0xdf0000
File size:	86'528 bytes
MD5 hash:	65485B0475B6C8A3B4F35BBA541938A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3310295199.0000000012FF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.3310295199.0000000012FF1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.2026730895.0000000000DF2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.2026730895.0000000000DF2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3278221040.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	18:33:45
Start date:	01/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\DriverUpdt.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	18:33:45
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	18:33:51
Start date:	01/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DriverUpdt.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	18:33:51
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	18:34:02
Start date:	01/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\DriverUpdt'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	18:34:02
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	18:34:18
Start date:	01/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DriverUpdt'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	18:34:18
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	18:34:39
Start date:	01/07/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DriverUpdt" /tr "C:\Users\user\AppData\Roaming\DriverUpdt"
Imagebase:	0x7ff753ed0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	18:34:39
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	18:34:41
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\DriverUpdt
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\DriverUpdt
Imagebase:	0x2d0000
File size:	86'528 bytes
MD5 hash:	65485B0475B6C8A3B4F35BBA541938A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\DriverUpdt, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\DriverUpdt, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\DriverUpdt, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	17
Start time:	18:34:51
Start date:	01/07/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff6cd8c0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	18
Start time:	18:34:51
Start date:	01/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	19
Start time:	18:34:59
Start date:	01/07/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff6cd8c0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	20
Start time:	18:35:01
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\DriverUpdt
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\DriverUpdt
Imagebase:	0x840000
File size:	86'528 bytes
MD5 hash:	65485B0475B6C8A3B4F35BBA541938A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true