Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe

Overview

General Information

Sample name: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
Analysis ID: 1475711
MD5: 7fda9f799b84a7ed802f7127869d5e81
SHA1: 55137aa833ee1653f52378599aad376073264499
SHA256: 96c861fca93e9209acb17b95b4253f3c26f483ad7dd9eebe15da3067299ef1ac
Tags: exe
Infos:

Detection

PureLog Stealer, XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Yara detected AntiVM3
Yara detected PureLog Stealer
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: moneymaker-30608.portmap.host Avira URL Cloud: Label: phishing
Found malware configuration
Source: 0000000F.00000002.1368873082.000000000341E000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Xworm {"C2 url": ["moneymaker-30608.portmap.host"], "Port": "30608", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.2"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\XClient.exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe ReversingLabs: Detection: 34%
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Virustotal: Detection: 36% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\XClient.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack String decryptor: moneymaker-30608.portmap.host
Source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack String decryptor: 30608
Source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack String decryptor: <123456789>
Source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack String decryptor: <Xwormmm>
Source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack String decryptor: XWorm V5.2
Source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack String decryptor: USB.exe
Source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack String decryptor: %AppData%
Source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack String decryptor: XClient.exe
Source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack String decryptor: bc1qz32y9es3p6hv6xs4kpqn4sqmrrr888qfyp67hm
Source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack String decryptor: 0xCe6C8E673e5d9aE4Ee7F357fE94b7EC06B52f3Fd
Source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack String decryptor: TSoemRqDkQLR8bnFkw6tsBTUAaAyCujx5y
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2855924 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.10:49708 -> 193.161.193.99:30608
Source: Traffic Snort IDS: 2852870 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes 193.161.193.99:30608 -> 192.168.2.10:49708
Source: Traffic Snort IDS: 2852923 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) 192.168.2.10:49708 -> 193.161.193.99:30608
Source: Traffic Snort IDS: 2852874 ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2 193.161.193.99:30608 -> 192.168.2.10:49708
Source: Traffic Snort IDS: 2853193 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.10:49708 -> 193.161.193.99:30608
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: moneymaker-30608.portmap.host
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.10:49708 -> 193.161.193.99:30608
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 193.161.193.99 193.161.193.99
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: BITREE-ASRU BITREE-ASRU
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: moneymaker-30608.portmap.host
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 00000001.00000002.1308339600.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 0000000E.00000002.3724466160.0000000002731000.00000004.00000800.00020000.00000000.sdmp, pNYyTm.exe, 0000000F.00000002.1368873082.000000000341E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, XLogger.cs .Net Code: KeyboardLayout
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, XLogger.cs .Net Code: KeyboardLayout
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 19.2.pNYyTm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 15.2.pNYyTm.exe.34379b0.3.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 15.2.pNYyTm.exe.342d6d4.4.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 15.2.pNYyTm.exe.34379b0.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000F.00000002.1368873082.000000000341E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000002.1308339600.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000013.00000002.1406626322.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Code function: 1_2_0144DE6C 1_2_0144DE6C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Code function: 1_2_059697E0 1_2_059697E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Code function: 14_2_00A94530 14_2_00A94530
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Code function: 14_2_00A91358 14_2_00A91358
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Code function: 14_2_00A93F38 14_2_00A93F38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Code function: 14_2_00A91A0A 14_2_00A91A0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Code function: 14_2_06452F70 14_2_06452F70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Code function: 14_2_06457C38 14_2_06457C38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Code function: 14_2_06459CD8 14_2_06459CD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Code function: 14_2_06453840 14_2_06453840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Code function: 14_2_06455788 14_2_06455788
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Code function: 14_2_06452C28 14_2_06452C28
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_019CDE6C 15_2_019CDE6C
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_06447CD8 15_2_06447CD8
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_064434E8 15_2_064434E8
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_06441559 15_2_06441559
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_06441568 15_2_06441568
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_064430B0 15_2_064430B0
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_06441130 15_2_06441130
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_06440CF8 15_2_06440CF8
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_064597E0 15_2_064597E0
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 19_2_012D1358 19_2_012D1358
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 00000001.00000002.1306863840.000000000114E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 00000001.00000002.1314250556.00000000055F0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameCAA.dll4 vs SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 00000001.00000002.1308339600.0000000002E81000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCAA.dll4 vs SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 00000001.00000000.1265344738.0000000000C26000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameQudI.exe" vs SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 00000001.00000002.1308339600.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamexraw.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 00000001.00000002.1315917095.0000000006020000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 00000001.00000002.1308667338.000000000405E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 0000000E.00000002.3727198558.0000000003731000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameQudI.exe" vs SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 0000000E.00000002.3728206247.0000000005639000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Binary or memory string: OriginalFilenameQudI.exe" vs SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 19.2.pNYyTm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 15.2.pNYyTm.exe.34379b0.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 15.2.pNYyTm.exe.342d6d4.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 15.2.pNYyTm.exe.34379b0.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000F.00000002.1368873082.000000000341E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000002.1308339600.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000013.00000002.1406626322.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: pNYyTm.exe.1.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ea2f20.1.raw.unpack, lNjw1JhxSV5n0cCMNW.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ea2f20.1.raw.unpack, lNjw1JhxSV5n0cCMNW.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.55f0000.7.raw.unpack, lNjw1JhxSV5n0cCMNW.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.55f0000.7.raw.unpack, lNjw1JhxSV5n0cCMNW.cs Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, fw1IB4uqclhjXGAZvN.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, fw1IB4uqclhjXGAZvN.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, QHOw32oMEn7lDsZbTi.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, QHOw32oMEn7lDsZbTi.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, QHOw32oMEn7lDsZbTi.cs Security API names: _0020.AddAccessRule
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, QHOw32oMEn7lDsZbTi.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, QHOw32oMEn7lDsZbTi.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, QHOw32oMEn7lDsZbTi.cs Security API names: _0020.AddAccessRule
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, QHOw32oMEn7lDsZbTi.cs Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, QHOw32oMEn7lDsZbTi.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, QHOw32oMEn7lDsZbTi.cs Security API names: _0020.AddAccessRule
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, fw1IB4uqclhjXGAZvN.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@20/18@1/1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe File created: C:\Users\user\AppData\Roaming\pNYyTm.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7948:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2088:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Mutant created: \Sessions\1\BaseNamedObjects\Gt5MojO5rBrt6ybL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7832:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7132:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe File created: C:\Users\user\AppData\Local\Temp\tmp496E.tmp Jump to behavior
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Virustotal: Detection: 36%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pNYyTm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pNYyTm" /XML "C:\Users\user\AppData\Local\Temp\tmp496E.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\pNYyTm.exe C:\Users\user\AppData\Roaming\pNYyTm.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pNYyTm" /XML "C:\Users\user\AppData\Local\Temp\tmp6051.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process created: C:\Users\user\AppData\Roaming\pNYyTm.exe "C:\Users\user\AppData\Roaming\pNYyTm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pNYyTm.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pNYyTm" /XML "C:\Users\user\AppData\Local\Temp\tmp496E.tmp" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pNYyTm" /XML "C:\Users\user\AppData\Local\Temp\tmp6051.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process created: C:\Users\user\AppData\Roaming\pNYyTm.exe "C:\Users\user\AppData\Roaming\pNYyTm.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ea2f20.1.raw.unpack, lNjw1JhxSV5n0cCMNW.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.55f0000.7.raw.unpack, lNjw1JhxSV5n0cCMNW.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
.NET source code contains potential unpacker
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, Main.cs .Net Code: InitializeComponent
Source: pNYyTm.exe.1.dr, Main.cs .Net Code: InitializeComponent
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, QHOw32oMEn7lDsZbTi.cs .Net Code: JKIbqNsWCmVV7OsXQC3 System.Reflection.Assembly.Load(byte[])
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, QHOw32oMEn7lDsZbTi.cs .Net Code: JKIbqNsWCmVV7OsXQC3 System.Reflection.Assembly.Load(byte[])
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, Messages.cs .Net Code: Memory
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, Messages.cs .Net Code: Memory
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, QHOw32oMEn7lDsZbTi.cs .Net Code: JKIbqNsWCmVV7OsXQC3 System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Code function: 1_2_05960B78 pushfd ; retf 1_2_05960B7C
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_064527EE push es; iretd 15_2_06452860
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_06450089 push es; iretd 15_2_06452860
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_064500AA push es; iretd 15_2_06452860
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_064500BF push es; iretd 15_2_06452860
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_0645014B push es; iretd 15_2_06452860
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_06450133 push es; iretd 15_2_06452860
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_06452C25 push es; ret 15_2_06452C3C
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_06452C3D push es; retf 15_2_06452D10
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Code function: 15_2_06450B78 pushfd ; retf 15_2_06450B7C
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Static PE information: section name: .text entropy: 7.966741357307765
Source: pNYyTm.exe.1.dr Static PE information: section name: .text entropy: 7.966741357307765
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ea2f20.1.raw.unpack, lNjw1JhxSV5n0cCMNW.cs High entropy of concatenated method names: 'Kb0HWSL22O', 'RgtTUJcyZL', 'jHu2HrxObq', 'UAF22bihQq', 'Hla2xZGvyo', 'XAB2tPq0q8', 'aeMUEk3AsB3Pt', 'xw8jvYcwb', 'eSADOWkF2', 'hfhQtMtDc'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ea2f20.1.raw.unpack, NkEtj4xdihRGcDPjVY.cs High entropy of concatenated method names: 'HVYMFtP2f', 'CuEekxjKf', 'WGqJ3oTFt', 'GCn1bRmSG', 'Kbtl1TeP0', 'Fy7hiDf8S', 'e5JqCGSck', 'C2SLkryPZ', 'ksT8NQvKO', 'zvqT1Z212'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.55f0000.7.raw.unpack, lNjw1JhxSV5n0cCMNW.cs High entropy of concatenated method names: 'Kb0HWSL22O', 'RgtTUJcyZL', 'jHu2HrxObq', 'UAF22bihQq', 'Hla2xZGvyo', 'XAB2tPq0q8', 'aeMUEk3AsB3Pt', 'xw8jvYcwb', 'eSADOWkF2', 'hfhQtMtDc'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.55f0000.7.raw.unpack, NkEtj4xdihRGcDPjVY.cs High entropy of concatenated method names: 'HVYMFtP2f', 'CuEekxjKf', 'WGqJ3oTFt', 'GCn1bRmSG', 'Kbtl1TeP0', 'Fy7hiDf8S', 'e5JqCGSck', 'C2SLkryPZ', 'ksT8NQvKO', 'zvqT1Z212'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, uBRAahgBpjjHAISb74.cs High entropy of concatenated method names: 'K3FmbY1YJR', 'NXdmPvYn5c', 'hH2mGZk25c', 'YgMm9U3gmc', 'SdWm5WBtpe', 's8Omyf2IGH', 'oN4m6bh4Fj', 'oAfKqiuc5L', 'BHgK2qjDZP', 'JBMK0R6hgB'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, tqIBqAREa8Q6WD82rO.cs High entropy of concatenated method names: 'oqepaiEAfx', 'O0ppMnjI6s', 'zASpuC6Uch', 'oNgpR5Bfx1', 'zihpLJfF5c', 'bYepcRpBqh', 'byFpH0hPBV', 'kbYpKSa3pa', 'slCpmXx3yQ', 'dY6pDERiVP'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, YrBo172giAk8gnYb5y.cs High entropy of concatenated method names: 'jLNK9RkpjU', 'jDqK5srB9y', 'YNFKpqQ605', 'mlSKyNMo96', 'pjAK6PEMCb', 'WmGK1gCAG8', 'SvCKoLnoxa', 'YBGKkbZ0J2', 'j66KAEF65s', 'm8DKseDxsn'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, IGROvpvPicb6LXDyW8.cs High entropy of concatenated method names: 'ToString', 'FRXceWUqUW', 'iWbcNSn1VL', 'WUOcYiy4nW', 'gfMcjosZX0', 'ec0cxHXLSb', 'z0xclwifYa', 'kEYcdamiwS', 'uDgcSWsyri', 'lEscCp8Zuy'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, cIaTm3psrRfHXmD1RG.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'oCan0wQVis', 'WZZng9b3wj', 'PWbnzhdT6U', 'MdHP4yE005', 'sclPbT9YI5', 'cdbPnVqbBV', 'SV7PPnnbeL', 'STlOBbsUV3bnGufXjvA'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, y6w8lanDc3YI69TWBE.cs High entropy of concatenated method names: 'nyeFQhnQR', 'ltLaMv2oY', 'dgdMFTuuV', 'AeX3aUBmU', 'MSRReNyvr', 'pyrhlU4rK', 'hPn8DBe9vHxtYNSPlh', 'qTHsxABh8jSIc25uaK', 'j9oKCMQAL', 'WirDCT9TW'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, fw1IB4uqclhjXGAZvN.cs High entropy of concatenated method names: 'TJS589BsFN', 'L4a5trh7oD', 'lGG5vR5eHt', 'Ai75Q0fsUC', 'uuR5VZA5yf', 'Ji15XF87XY', 'tJi5qpmvY6', 'gd352If2fk', 'vD750Tpdrt', 'gu45gerD22'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, h8IVSedMFQpixvNuAY.cs High entropy of concatenated method names: 'Uop19Sv7oZ', 'LCh1p4ygHC', 'wdD16GfXSs', 'mug6gL0SJi', 'QJr6zPMSRV', 'rRL14BF3S1', 'U6g1b2UMtm', 't5e1nGkEWF', 'ner1P78PNi', 'Nmd1GOvoiU'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, rqtLsRCgxuqruShBFT.cs High entropy of concatenated method names: 'X0i1TxqR1y', 'W281BHixDh', 'd7X1Ff5JqD', 'ucp1a6P03u', 'tSi1OWedCB', 'SNL1MYapKf', 'W7M13s0Vda', 'WFy1u5BEQp', 'Kmp1Rj5jkl', 'e7P1hLmcf6'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, tAI8DEb4LaCGCcG8H2k.cs High entropy of concatenated method names: 'dugmTYxeIh', 'sLQmBDpYo7', 'pkamF2fsW8', 'j9vmaWG1Iy', 'NpwmOFd8QN', 'irrmM5eVXr', 'b4cm3kDtwx', 's3LmuMG0k7', 'lbqmRgYJJd', 'DjlmhFTXcf'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, plmLCiQhBDHul7rqkX.cs High entropy of concatenated method names: 'r0JHA2EhL5', 'pc5HstfjIL', 'ToString', 'ivhH9JrlJV', 'YTjH5EvEX2', 'TiaHpWwtHB', 'rKsHymhbFF', 'zGWH66NIxk', 'sGuH1ZFB4s', 'HylHouSDZA'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, OrioeaGQ0PM1syyFSu.cs High entropy of concatenated method names: 'Wh9b1w1IB4', 'VclbohjXGA', 'lEabA8Q6WD', 'R2rbsOixDH', 'LWfbLWVXXg', 'GQTbcuS7Mq', 'AfX9rYZ8AUDXabg2KR', 'NsuwOIG8KB3G8YZtXj', 'JgqbbYma98', 'WKkbPIUESW'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, QHOw32oMEn7lDsZbTi.cs High entropy of concatenated method names: 'PaDPJcZBwj', 'm6BP9oHuFS', 'vTrP5EGsJ9', 'DivPprJBnB', 'kCkPyW7e3L', 'DgtP6Iy9MZ', 'UhfP1B1IsJ', 'ig2PodeqMd', 'gLgPkiaAA3', 'HDVPAwpcL7'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, JAtyCrXlg8pJIddapt.cs High entropy of concatenated method names: 'OqNH2OyRYv', 'Y3iHgyVFry', 'p8DK40Kvm2', 'YfIKbdCXLX', 'uCEHemnlm9', 'itoHwsc5sD', 'lQBHrenmsy', 'MLGH8TxLs8', 'q6fHtUsZFS', 'gSyHvxVuE5'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, PT5L9M0MhqK8Q0f7MB.cs High entropy of concatenated method names: 'B0SKi9RZAa', 'alYKNVsR4I', 'k6tKYAZiXt', 'WyEKjouC94', 'p0dK8xMR1K', 'xHPKxNP1Vg', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, xZ6IqqbPfae5139K1hU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LCoD8uLU3x', 'M3PDt3SWOp', 'sEFDvqlpbx', 'cWxDQkJDKy', 'aaVDVfODUy', 'EJnDXHFVk8', 'GrYDqwbkrk'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, VXgNQTiuS7Mq9yDKkD.cs High entropy of concatenated method names: 'VIl6J7ofwG', 'EKZ65uyQIS', 'S9M6yIycuy', 'dte61lTb4u', 'C996oyvDog', 'k8jyVMvgw2', 'zByyXhWeBH', 'CpVyqFV9G3', 'Hwny2GwGDL', 'kq1y0OpTMX'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, zV7Ah65u26UDaxa1D3.cs High entropy of concatenated method names: 'Dispose', 'sZEb08TIDQ', 'fYXnNaZava', 'gtHwwSs2oe', 'egrbgBo17g', 'GAkbz8gnYb', 'ProcessDialogKey', 'gyrn4T5L9M', 'ChqnbK8Q0f', 'nMBnnIBRAa'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, Nv3sLXzlWLSj3jB4F1.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 't0em7AeEpF', 'uXNmLZqKNN', 'JnLmcJvsgi', 'uprmHglUZF', 'vgQmKXd0hK', 'FEXmmalpvG', 'NZlmDerdZd'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40b1230.6.raw.unpack, edf7UgrQnKs2ebtqMV.cs High entropy of concatenated method names: 'BDm7uAuotw', 'vG27RY96eC', 'iW47iBP8JB', 'Lwt7NFCxOA', 'uKN7jqTyEJ', 'Xa07x7hUPt', 'yF47dUmTPc', 'cGG7SrSnk6', 'Vsb7UKZ7CN', 'vdF7enRR2s'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, uBRAahgBpjjHAISb74.cs High entropy of concatenated method names: 'K3FmbY1YJR', 'NXdmPvYn5c', 'hH2mGZk25c', 'YgMm9U3gmc', 'SdWm5WBtpe', 's8Omyf2IGH', 'oN4m6bh4Fj', 'oAfKqiuc5L', 'BHgK2qjDZP', 'JBMK0R6hgB'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, tqIBqAREa8Q6WD82rO.cs High entropy of concatenated method names: 'oqepaiEAfx', 'O0ppMnjI6s', 'zASpuC6Uch', 'oNgpR5Bfx1', 'zihpLJfF5c', 'bYepcRpBqh', 'byFpH0hPBV', 'kbYpKSa3pa', 'slCpmXx3yQ', 'dY6pDERiVP'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, YrBo172giAk8gnYb5y.cs High entropy of concatenated method names: 'jLNK9RkpjU', 'jDqK5srB9y', 'YNFKpqQ605', 'mlSKyNMo96', 'pjAK6PEMCb', 'WmGK1gCAG8', 'SvCKoLnoxa', 'YBGKkbZ0J2', 'j66KAEF65s', 'm8DKseDxsn'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, IGROvpvPicb6LXDyW8.cs High entropy of concatenated method names: 'ToString', 'FRXceWUqUW', 'iWbcNSn1VL', 'WUOcYiy4nW', 'gfMcjosZX0', 'ec0cxHXLSb', 'z0xclwifYa', 'kEYcdamiwS', 'uDgcSWsyri', 'lEscCp8Zuy'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, cIaTm3psrRfHXmD1RG.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'oCan0wQVis', 'WZZng9b3wj', 'PWbnzhdT6U', 'MdHP4yE005', 'sclPbT9YI5', 'cdbPnVqbBV', 'SV7PPnnbeL', 'STlOBbsUV3bnGufXjvA'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, y6w8lanDc3YI69TWBE.cs High entropy of concatenated method names: 'nyeFQhnQR', 'ltLaMv2oY', 'dgdMFTuuV', 'AeX3aUBmU', 'MSRReNyvr', 'pyrhlU4rK', 'hPn8DBe9vHxtYNSPlh', 'qTHsxABh8jSIc25uaK', 'j9oKCMQAL', 'WirDCT9TW'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, fw1IB4uqclhjXGAZvN.cs High entropy of concatenated method names: 'TJS589BsFN', 'L4a5trh7oD', 'lGG5vR5eHt', 'Ai75Q0fsUC', 'uuR5VZA5yf', 'Ji15XF87XY', 'tJi5qpmvY6', 'gd352If2fk', 'vD750Tpdrt', 'gu45gerD22'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, h8IVSedMFQpixvNuAY.cs High entropy of concatenated method names: 'Uop19Sv7oZ', 'LCh1p4ygHC', 'wdD16GfXSs', 'mug6gL0SJi', 'QJr6zPMSRV', 'rRL14BF3S1', 'U6g1b2UMtm', 't5e1nGkEWF', 'ner1P78PNi', 'Nmd1GOvoiU'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, rqtLsRCgxuqruShBFT.cs High entropy of concatenated method names: 'X0i1TxqR1y', 'W281BHixDh', 'd7X1Ff5JqD', 'ucp1a6P03u', 'tSi1OWedCB', 'SNL1MYapKf', 'W7M13s0Vda', 'WFy1u5BEQp', 'Kmp1Rj5jkl', 'e7P1hLmcf6'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, tAI8DEb4LaCGCcG8H2k.cs High entropy of concatenated method names: 'dugmTYxeIh', 'sLQmBDpYo7', 'pkamF2fsW8', 'j9vmaWG1Iy', 'NpwmOFd8QN', 'irrmM5eVXr', 'b4cm3kDtwx', 's3LmuMG0k7', 'lbqmRgYJJd', 'DjlmhFTXcf'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, plmLCiQhBDHul7rqkX.cs High entropy of concatenated method names: 'r0JHA2EhL5', 'pc5HstfjIL', 'ToString', 'ivhH9JrlJV', 'YTjH5EvEX2', 'TiaHpWwtHB', 'rKsHymhbFF', 'zGWH66NIxk', 'sGuH1ZFB4s', 'HylHouSDZA'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, OrioeaGQ0PM1syyFSu.cs High entropy of concatenated method names: 'Wh9b1w1IB4', 'VclbohjXGA', 'lEabA8Q6WD', 'R2rbsOixDH', 'LWfbLWVXXg', 'GQTbcuS7Mq', 'AfX9rYZ8AUDXabg2KR', 'NsuwOIG8KB3G8YZtXj', 'JgqbbYma98', 'WKkbPIUESW'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, QHOw32oMEn7lDsZbTi.cs High entropy of concatenated method names: 'PaDPJcZBwj', 'm6BP9oHuFS', 'vTrP5EGsJ9', 'DivPprJBnB', 'kCkPyW7e3L', 'DgtP6Iy9MZ', 'UhfP1B1IsJ', 'ig2PodeqMd', 'gLgPkiaAA3', 'HDVPAwpcL7'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, JAtyCrXlg8pJIddapt.cs High entropy of concatenated method names: 'OqNH2OyRYv', 'Y3iHgyVFry', 'p8DK40Kvm2', 'YfIKbdCXLX', 'uCEHemnlm9', 'itoHwsc5sD', 'lQBHrenmsy', 'MLGH8TxLs8', 'q6fHtUsZFS', 'gSyHvxVuE5'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, PT5L9M0MhqK8Q0f7MB.cs High entropy of concatenated method names: 'B0SKi9RZAa', 'alYKNVsR4I', 'k6tKYAZiXt', 'WyEKjouC94', 'p0dK8xMR1K', 'xHPKxNP1Vg', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, xZ6IqqbPfae5139K1hU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LCoD8uLU3x', 'M3PDt3SWOp', 'sEFDvqlpbx', 'cWxDQkJDKy', 'aaVDVfODUy', 'EJnDXHFVk8', 'GrYDqwbkrk'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, VXgNQTiuS7Mq9yDKkD.cs High entropy of concatenated method names: 'VIl6J7ofwG', 'EKZ65uyQIS', 'S9M6yIycuy', 'dte61lTb4u', 'C996oyvDog', 'k8jyVMvgw2', 'zByyXhWeBH', 'CpVyqFV9G3', 'Hwny2GwGDL', 'kq1y0OpTMX'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, zV7Ah65u26UDaxa1D3.cs High entropy of concatenated method names: 'Dispose', 'sZEb08TIDQ', 'fYXnNaZava', 'gtHwwSs2oe', 'egrbgBo17g', 'GAkbz8gnYb', 'ProcessDialogKey', 'gyrn4T5L9M', 'ChqnbK8Q0f', 'nMBnnIBRAa'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, Nv3sLXzlWLSj3jB4F1.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 't0em7AeEpF', 'uXNmLZqKNN', 'JnLmcJvsgi', 'uprmHglUZF', 'vgQmKXd0hK', 'FEXmmalpvG', 'NZlmDerdZd'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.40fcc50.5.raw.unpack, edf7UgrQnKs2ebtqMV.cs High entropy of concatenated method names: 'BDm7uAuotw', 'vG27RY96eC', 'iW47iBP8JB', 'Lwt7NFCxOA', 'uKN7jqTyEJ', 'Xa07x7hUPt', 'yF47dUmTPc', 'cGG7SrSnk6', 'Vsb7UKZ7CN', 'vdF7enRR2s'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, uBRAahgBpjjHAISb74.cs High entropy of concatenated method names: 'K3FmbY1YJR', 'NXdmPvYn5c', 'hH2mGZk25c', 'YgMm9U3gmc', 'SdWm5WBtpe', 's8Omyf2IGH', 'oN4m6bh4Fj', 'oAfKqiuc5L', 'BHgK2qjDZP', 'JBMK0R6hgB'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, tqIBqAREa8Q6WD82rO.cs High entropy of concatenated method names: 'oqepaiEAfx', 'O0ppMnjI6s', 'zASpuC6Uch', 'oNgpR5Bfx1', 'zihpLJfF5c', 'bYepcRpBqh', 'byFpH0hPBV', 'kbYpKSa3pa', 'slCpmXx3yQ', 'dY6pDERiVP'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, YrBo172giAk8gnYb5y.cs High entropy of concatenated method names: 'jLNK9RkpjU', 'jDqK5srB9y', 'YNFKpqQ605', 'mlSKyNMo96', 'pjAK6PEMCb', 'WmGK1gCAG8', 'SvCKoLnoxa', 'YBGKkbZ0J2', 'j66KAEF65s', 'm8DKseDxsn'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, IGROvpvPicb6LXDyW8.cs High entropy of concatenated method names: 'ToString', 'FRXceWUqUW', 'iWbcNSn1VL', 'WUOcYiy4nW', 'gfMcjosZX0', 'ec0cxHXLSb', 'z0xclwifYa', 'kEYcdamiwS', 'uDgcSWsyri', 'lEscCp8Zuy'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, cIaTm3psrRfHXmD1RG.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'oCan0wQVis', 'WZZng9b3wj', 'PWbnzhdT6U', 'MdHP4yE005', 'sclPbT9YI5', 'cdbPnVqbBV', 'SV7PPnnbeL', 'STlOBbsUV3bnGufXjvA'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, y6w8lanDc3YI69TWBE.cs High entropy of concatenated method names: 'nyeFQhnQR', 'ltLaMv2oY', 'dgdMFTuuV', 'AeX3aUBmU', 'MSRReNyvr', 'pyrhlU4rK', 'hPn8DBe9vHxtYNSPlh', 'qTHsxABh8jSIc25uaK', 'j9oKCMQAL', 'WirDCT9TW'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, fw1IB4uqclhjXGAZvN.cs High entropy of concatenated method names: 'TJS589BsFN', 'L4a5trh7oD', 'lGG5vR5eHt', 'Ai75Q0fsUC', 'uuR5VZA5yf', 'Ji15XF87XY', 'tJi5qpmvY6', 'gd352If2fk', 'vD750Tpdrt', 'gu45gerD22'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, h8IVSedMFQpixvNuAY.cs High entropy of concatenated method names: 'Uop19Sv7oZ', 'LCh1p4ygHC', 'wdD16GfXSs', 'mug6gL0SJi', 'QJr6zPMSRV', 'rRL14BF3S1', 'U6g1b2UMtm', 't5e1nGkEWF', 'ner1P78PNi', 'Nmd1GOvoiU'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, rqtLsRCgxuqruShBFT.cs High entropy of concatenated method names: 'X0i1TxqR1y', 'W281BHixDh', 'd7X1Ff5JqD', 'ucp1a6P03u', 'tSi1OWedCB', 'SNL1MYapKf', 'W7M13s0Vda', 'WFy1u5BEQp', 'Kmp1Rj5jkl', 'e7P1hLmcf6'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, tAI8DEb4LaCGCcG8H2k.cs High entropy of concatenated method names: 'dugmTYxeIh', 'sLQmBDpYo7', 'pkamF2fsW8', 'j9vmaWG1Iy', 'NpwmOFd8QN', 'irrmM5eVXr', 'b4cm3kDtwx', 's3LmuMG0k7', 'lbqmRgYJJd', 'DjlmhFTXcf'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, plmLCiQhBDHul7rqkX.cs High entropy of concatenated method names: 'r0JHA2EhL5', 'pc5HstfjIL', 'ToString', 'ivhH9JrlJV', 'YTjH5EvEX2', 'TiaHpWwtHB', 'rKsHymhbFF', 'zGWH66NIxk', 'sGuH1ZFB4s', 'HylHouSDZA'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, OrioeaGQ0PM1syyFSu.cs High entropy of concatenated method names: 'Wh9b1w1IB4', 'VclbohjXGA', 'lEabA8Q6WD', 'R2rbsOixDH', 'LWfbLWVXXg', 'GQTbcuS7Mq', 'AfX9rYZ8AUDXabg2KR', 'NsuwOIG8KB3G8YZtXj', 'JgqbbYma98', 'WKkbPIUESW'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, QHOw32oMEn7lDsZbTi.cs High entropy of concatenated method names: 'PaDPJcZBwj', 'm6BP9oHuFS', 'vTrP5EGsJ9', 'DivPprJBnB', 'kCkPyW7e3L', 'DgtP6Iy9MZ', 'UhfP1B1IsJ', 'ig2PodeqMd', 'gLgPkiaAA3', 'HDVPAwpcL7'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, JAtyCrXlg8pJIddapt.cs High entropy of concatenated method names: 'OqNH2OyRYv', 'Y3iHgyVFry', 'p8DK40Kvm2', 'YfIKbdCXLX', 'uCEHemnlm9', 'itoHwsc5sD', 'lQBHrenmsy', 'MLGH8TxLs8', 'q6fHtUsZFS', 'gSyHvxVuE5'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, PT5L9M0MhqK8Q0f7MB.cs High entropy of concatenated method names: 'B0SKi9RZAa', 'alYKNVsR4I', 'k6tKYAZiXt', 'WyEKjouC94', 'p0dK8xMR1K', 'xHPKxNP1Vg', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, xZ6IqqbPfae5139K1hU.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LCoD8uLU3x', 'M3PDt3SWOp', 'sEFDvqlpbx', 'cWxDQkJDKy', 'aaVDVfODUy', 'EJnDXHFVk8', 'GrYDqwbkrk'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, VXgNQTiuS7Mq9yDKkD.cs High entropy of concatenated method names: 'VIl6J7ofwG', 'EKZ65uyQIS', 'S9M6yIycuy', 'dte61lTb4u', 'C996oyvDog', 'k8jyVMvgw2', 'zByyXhWeBH', 'CpVyqFV9G3', 'Hwny2GwGDL', 'kq1y0OpTMX'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, zV7Ah65u26UDaxa1D3.cs High entropy of concatenated method names: 'Dispose', 'sZEb08TIDQ', 'fYXnNaZava', 'gtHwwSs2oe', 'egrbgBo17g', 'GAkbz8gnYb', 'ProcessDialogKey', 'gyrn4T5L9M', 'ChqnbK8Q0f', 'nMBnnIBRAa'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, Nv3sLXzlWLSj3jB4F1.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 't0em7AeEpF', 'uXNmLZqKNN', 'JnLmcJvsgi', 'uprmHglUZF', 'vgQmKXd0hK', 'FEXmmalpvG', 'NZlmDerdZd'
Source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.6020000.9.raw.unpack, edf7UgrQnKs2ebtqMV.cs High entropy of concatenated method names: 'BDm7uAuotw', 'vG27RY96eC', 'iW47iBP8JB', 'Lwt7NFCxOA', 'uKN7jqTyEJ', 'Xa07x7hUPt', 'yF47dUmTPc', 'cGG7SrSnk6', 'Vsb7UKZ7CN', 'vdF7enRR2s'
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe File created: C:\Users\user\AppData\Roaming\pNYyTm.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe File created: C:\Users\user\AppData\Roaming\XClient.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pNYyTm" /XML "C:\Users\user\AppData\Local\Temp\tmp496E.tmp"
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe PID: 7352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: pNYyTm.exe PID: 8164, type: MEMORYSTR
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Memory allocated: 1440000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Memory allocated: 2E80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Memory allocated: 4E80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Memory allocated: 62E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Memory allocated: 72E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Memory allocated: 7520000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Memory allocated: 8520000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Memory allocated: A90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Memory allocated: 2730000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Memory allocated: 2660000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Memory allocated: 19C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Memory allocated: 33C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Memory allocated: 3180000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Memory allocated: 66B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Memory allocated: 76B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Memory allocated: 66B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Memory allocated: 1270000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Memory allocated: 3050000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Memory allocated: 1810000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7246 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 483 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8291 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 543 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Window / User API: threadDelayed 4439 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Window / User API: threadDelayed 5368 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe TID: 7384 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8140 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8048 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8148 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8040 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe TID: 2968 Thread sleep time: -14757395258967632s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe TID: 8184 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe TID: 2112 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Thread delayed: delay time: 922337203685477
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 0000000E.00000002.3722141576.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 00000001.00000002.1315775861.0000000005F39000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: pNYyTm.exe, 0000000F.00000002.1371407979.0000000005CB0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 00000001.00000002.1315775861.0000000005F39000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pNYyTm.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pNYyTm.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Memory written: C:\Users\user\AppData\Roaming\pNYyTm.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\pNYyTm.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pNYyTm" /XML "C:\Users\user\AppData\Local\Temp\tmp496E.tmp" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pNYyTm" /XML "C:\Users\user\AppData\Local\Temp\tmp6051.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Process created: C:\Users\user\AppData\Roaming\pNYyTm.exe "C:\Users\user\AppData\Roaming\pNYyTm.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Queries volume information: C:\Users\user\AppData\Roaming\pNYyTm.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Queries volume information: C:\Users\user\AppData\Roaming\pNYyTm.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\pNYyTm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe, 0000000E.00000002.3722141576.0000000000C19000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information
barindex
Yara detected PureLog Stealer
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.55f0000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.55f0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.pNYyTm.exe.33e2d7c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ea2f20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ea2f20.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.pNYyTm.exe.33e2d7c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.1314250556.00000000055F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1368873082.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1308339600.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected XWorm
Source: Yara match File source: 19.2.pNYyTm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.pNYyTm.exe.34379b0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.pNYyTm.exe.342d6d4.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.pNYyTm.exe.34379b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.1368873082.000000000341E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1308339600.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.1406626322.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.3724466160.0000000002731000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe PID: 7352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe PID: 8096, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: pNYyTm.exe PID: 8164, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: pNYyTm.exe PID: 1132, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected PureLog Stealer
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.55f0000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.55f0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.pNYyTm.exe.33e2d7c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ea2f20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ea2f20.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.pNYyTm.exe.33e2d7c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.1314250556.00000000055F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1368873082.00000000033C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1308339600.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected XWorm
Source: Yara match File source: 19.2.pNYyTm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.pNYyTm.exe.34379b0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.pNYyTm.exe.342d6d4.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.pNYyTm.exe.342d6d4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.pNYyTm.exe.34379b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2ef6154.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe.2eebe78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.1368873082.000000000341E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1308339600.0000000002EDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.1406626322.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.3724466160.0000000002731000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe PID: 7352, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe PID: 8096, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: pNYyTm.exe PID: 8164, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: pNYyTm.exe PID: 1132, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1475711 Sample: SecuriteInfo.com.Win32.PWSX... Startdate: 18/07/2024 Architecture: WINDOWS Score: 100 51 moneymaker-30608.portmap.host 2->51 57 Snort IDS alert for network traffic 2->57 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 16 other signatures 2->63 8 SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe 7 2->8         started        12 pNYyTm.exe 5 2->12         started        signatures3 process4 file5 41 C:\Users\user\AppData\Roaming\pNYyTm.exe, PE32 8->41 dropped 43 C:\Users\user\...\pNYyTm.exe:Zone.Identifier, ASCII 8->43 dropped 45 C:\Users\user\AppData\Local\...\tmp496E.tmp, XML 8->45 dropped 47 SecuriteInfo.com.W....1456.22106.exe.log, ASCII 8->47 dropped 65 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->65 67 Uses schtasks.exe or at.exe to add and modify task schedules 8->67 69 Adds a directory exclusion to Windows Defender 8->69 14 SecuriteInfo.com.Win32.PWSX-gen.1456.22106.exe 6 8->14         started        18 powershell.exe 22 8->18         started        21 powershell.exe 22 8->21         started        23 schtasks.exe 1 8->23         started        71 Multi AV Scanner detection for dropped file 12->71 73 Machine Learning detection for dropped file 12->73 75 Injects a PE file into a foreign processes 12->75 25 schtasks.exe 12->25         started        27 pNYyTm.exe 12->27         started        signatures6 process7 dnsIp8 53 moneymaker-30608.portmap.host 193.161.193.99, 30608, 49708 BITREE-ASRU Russian Federation 14->53 49 C:\Users\user\AppData\Roaming\XClient.exe, PE32 14->49 dropped 55 Loading BitLocker PowerShell Module 18->55 29 conhost.exe 18->29         started        31 WmiPrvSE.exe 18->31         started        33 conhost.exe 18->33         started        35 conhost.exe 21->35         started        37 conhost.exe 23->37         started        39 conhost.exe 25->39         started        file9 signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
193.161.193.99
 moneymaker-30608.portmap.host Russian Federation
198134 BITREE-ASRU true

Contacted Domains

Name IP Active
moneymaker-30608.portmap.host 193.161.193.99 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
moneymaker-30608.portmap.host true
  • Avira URL Cloud: phishing
 unknown