Windows Analysis Report
SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe

Overview

General Information

Sample name: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe
Analysis ID: 1476041
MD5: dc674885e842e9c05644ce23f5d8b665
SHA1: 82b33f0734fa62ddd93f1dfdc34285e8713b3e66
SHA256: ea098f4397146a44801177898a66a0da04690d51a242c5687b5e2d33afae1bfd
Tags: exe
Infos:

Detection

PureLog Stealer, XWorm
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Yara detected AntiVM3
Yara detected PureLog Stealer
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: moneymaker-30608.portmap.host Avira URL Cloud: Label: phishing
Found malware configuration
Source: 0000000A.00000002.2263227779.0000000002D21000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Xworm {"C2 url": ["moneymaker-30608.portmap.host"], "Port": "30608", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.2"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\XClient.exe ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe ReversingLabs: Detection: 31%
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe ReversingLabs: Detection: 31%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\XClient.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack String decryptor: moneymaker-30608.portmap.host
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack String decryptor: 30608
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack String decryptor: <123456789>
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack String decryptor: <Xwormmm>
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack String decryptor: XWorm V5.2
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack String decryptor: USB.exe
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack String decryptor: %AppData%
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack String decryptor: XClient.exe
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack String decryptor: bc1qz32y9es3p6hv6xs4kpqn4sqmrrr888qfyp67hm
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack String decryptor: 0xCe6C8E673e5d9aE4Ee7F357fE94b7EC06B52f3Fd
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack String decryptor: TSoemRqDkQLR8bnFkw6tsBTUAaAyCujx5y
Uses 32bit PE files
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2855924 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.6:49717 -> 193.161.193.99:30608
Source: Traffic Snort IDS: 2852870 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes 193.161.193.99:30608 -> 192.168.2.6:49717
Source: Traffic Snort IDS: 2852923 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) 192.168.2.6:49717 -> 193.161.193.99:30608
Source: Traffic Snort IDS: 2852874 ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2 193.161.193.99:30608 -> 192.168.2.6:49717
Source: Traffic Snort IDS: 2853193 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.6:49717 -> 193.161.193.99:30608
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: moneymaker-30608.portmap.host
Yara detected Generic Downloader
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d51004.2.raw.unpack, type: UNPACKEDPE
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:49717 -> 193.161.193.99:30608
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 193.161.193.99 193.161.193.99
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: BITREE-ASRU BITREE-ASRU
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: moneymaker-30608.portmap.host
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000000.00000002.2200717075.0000000002551000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000009.00000002.4633950904.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, xNgpESfQOvfb.exe, 0000000A.00000002.2263227779.0000000002D21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, XLogger.cs .Net Code: KeyboardLayout
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, XLogger.cs .Net Code: KeyboardLayout
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 10.2.xNgpESfQOvfb.exe.2d8f19c.1.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 10.2.xNgpESfQOvfb.exe.2d99478.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 15.2.xNgpESfQOvfb.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 10.2.xNgpESfQOvfb.exe.2d99478.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 10.2.xNgpESfQOvfb.exe.2d51004.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 10.2.xNgpESfQOvfb.exe.2d8f19c.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000F.00000002.2297610217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000A.00000002.2263227779.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2200717075.0000000002551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
.NET source code contains very large array initializations
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, MilkSales.cs Large array initialization: : array initializer size 494327
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_00ADDA34 0_2_00ADDA34
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_056A0690 0_2_056A0690
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_056A0680 0_2_056A0680
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_07083B70 0_2_07083B70
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_0708BB69 0_2_0708BB69
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_0708BB78 0_2_0708BB78
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_07083910 0_2_07083910
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_071DB048 0_2_071DB048
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_071D3610 0_2_071D3610
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_071D3A48 0_2_071D3A48
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_071D59B8 0_2_071D59B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_071D31D8 0_2_071D31D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_071D59C8 0_2_071D59C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_071D31C0 0_2_071D31C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_071D50F0 0_2_071D50F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 9_2_015D1358 9_2_015D1358
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 9_2_015D3878 9_2_015D3878
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 9_2_015D3F48 9_2_015D3F48
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_0100DA34 10_2_0100DA34
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_07583B70 10_2_07583B70
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_07583B5F 10_2_07583B5F
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_0758BB78 10_2_0758BB78
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_0758BB69 10_2_0758BB69
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_07583910 10_2_07583910
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_075838F0 10_2_075838F0
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_0782A4B0 10_2_0782A4B0
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_07823610 10_2_07823610
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_07823A48 10_2_07823A48
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_078259B8 10_2_078259B8
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_078231C0 10_2_078231C0
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_078259C8 10_2_078259C8
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_078231D8 10_2_078231D8
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_078250F0 10_2_078250F0
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 15_2_013A1358 15_2_013A1358
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000000.00000002.2198229058.00000000006CE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000000.00000002.2211596970.00000000077E0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000000.00000002.2201111262.0000000003643000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000000.00000002.2200717075.0000000002551000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCAA.dll4 vs SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000000.00000002.2200717075.0000000002551000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamexraw.exe4 vs SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000000.00000002.2208561504.0000000006D50000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUnIuy.exe" vs SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000000.00000000.2153793589.00000000001C2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameUnIuy.exe" vs SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000000.00000002.2209442377.0000000007060000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameCAA.dll4 vs SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000009.00000002.4628623821.00000000011F7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000009.00000002.4639187944.0000000005E09000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000009.00000002.4637476925.0000000003F71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUnIuy.exe" vs SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Binary or memory string: OriginalFilenameUnIuy.exe" vs SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe
Uses 32bit PE files
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 10.2.xNgpESfQOvfb.exe.2d8f19c.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 10.2.xNgpESfQOvfb.exe.2d99478.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 15.2.xNgpESfQOvfb.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 10.2.xNgpESfQOvfb.exe.2d99478.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 10.2.xNgpESfQOvfb.exe.2d51004.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 10.2.xNgpESfQOvfb.exe.2d8f19c.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000F.00000002.2297610217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000A.00000002.2263227779.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2200717075.0000000002551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: xNgpESfQOvfb.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.raw.unpack, lNjw1JhxSV5n0cCMNW.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.raw.unpack, lNjw1JhxSV5n0cCMNW.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.7060000.6.raw.unpack, lNjw1JhxSV5n0cCMNW.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.7060000.6.raw.unpack, lNjw1JhxSV5n0cCMNW.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, Helper.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, AlgorithmAES.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, HE2n9dW4U1DsdVPZZK.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, HE2n9dW4U1DsdVPZZK.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, HE2n9dW4U1DsdVPZZK.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, ClientSocket.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, coAw41HW9K74cRgqAt.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@21/18@1/1
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe File created: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3816:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2136:120:WilError_03
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1924:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5792:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Mutant created: \Sessions\1\BaseNamedObjects\Gt5MojO5rBrt6ybL
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe File created: C:\Users\user\AppData\Local\Temp\tmpA395.tmp Jump to behavior
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe ReversingLabs: Detection: 31%
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe "C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xNgpESfQOvfb" /XML "C:\Users\user\AppData\Local\Temp\tmpA395.tmp"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe "C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xNgpESfQOvfb" /XML "C:\Users\user\AppData\Local\Temp\tmp9832.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process created: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe "C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe"
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process created: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe "C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xNgpESfQOvfb" /XML "C:\Users\user\AppData\Local\Temp\tmpA395.tmp" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe "C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xNgpESfQOvfb" /XML "C:\Users\user\AppData\Local\Temp\tmp9832.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process created: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe "C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process created: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe "C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.raw.unpack, lNjw1JhxSV5n0cCMNW.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.7060000.6.raw.unpack, lNjw1JhxSV5n0cCMNW.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, Messages.cs .Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
.NET source code contains potential unpacker
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, Login.cs .Net Code: InitializeComponent
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, Messages.cs .Net Code: Memory
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, Messages.cs .Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, Messages.cs .Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, Messages.cs .Net Code: Memory
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, HE2n9dW4U1DsdVPZZK.cs .Net Code: WQUYEM92kf System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_056AB057 push 00000005h; retf 0_2_056AB0B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_056AB0F7 push 00000005h; retf 0_2_056AB0B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_0708D41E push esp; iretd 0_2_0708D421
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_070861B8 pushfd ; retf 0_2_070861BC
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Code function: 0_2_071D87A8 push esp; retf 0_2_071D87A9
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_0758D41E push esp; iretd 10_2_0758D421
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_075861B8 pushfd ; retf 10_2_075861BC
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_07827F3B pushfd ; ret 10_2_07827F41
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_07827EF3 push esp; ret 10_2_07827EF9
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_078242D9 push ebx; ret 10_2_078242DA
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_07829003 push esp; iretd 10_2_07829009
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Code function: 10_2_0782906B pushfd ; iretd 10_2_07829071
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Static PE information: section name: .text entropy: 7.717538065664358
Source: xNgpESfQOvfb.exe.0.dr Static PE information: section name: .text entropy: 7.717538065664358
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.raw.unpack, lNjw1JhxSV5n0cCMNW.cs High entropy of concatenated method names: 'Kb0HWSL22O', 'RgtTUJcyZL', 'jHu2HrxObq', 'UAF22bihQq', 'Hla2xZGvyo', 'XAB2tPq0q8', 'aeMUEk3AsB3Pt', 'xw8jvYcwb', 'eSADOWkF2', 'hfhQtMtDc'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.raw.unpack, NkEtj4xdihRGcDPjVY.cs High entropy of concatenated method names: 'HVYMFtP2f', 'CuEekxjKf', 'WGqJ3oTFt', 'GCn1bRmSG', 'Kbtl1TeP0', 'Fy7hiDf8S', 'e5JqCGSck', 'C2SLkryPZ', 'ksT8NQvKO', 'zvqT1Z212'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.7060000.6.raw.unpack, lNjw1JhxSV5n0cCMNW.cs High entropy of concatenated method names: 'Kb0HWSL22O', 'RgtTUJcyZL', 'jHu2HrxObq', 'UAF22bihQq', 'Hla2xZGvyo', 'XAB2tPq0q8', 'aeMUEk3AsB3Pt', 'xw8jvYcwb', 'eSADOWkF2', 'hfhQtMtDc'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.7060000.6.raw.unpack, NkEtj4xdihRGcDPjVY.cs High entropy of concatenated method names: 'HVYMFtP2f', 'CuEekxjKf', 'WGqJ3oTFt', 'GCn1bRmSG', 'Kbtl1TeP0', 'Fy7hiDf8S', 'e5JqCGSck', 'C2SLkryPZ', 'ksT8NQvKO', 'zvqT1Z212'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, JI4vkvhZNFR6VPxsSYH.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'eIlLMT42tu', 'cpeLxkCWHZ', 'tv4LK99ryr', 'uxoLRD4PcS', 'YjELoReim3', 'ucuLXtbw1h', 'FD9L0pYyGp'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, Mp9dr9heXowoDfUBc7f.cs High entropy of concatenated method names: 'juQPub4LRd', 'VkcP2hsoBx', 'H4BPEOPojm', 'KxBPldmP3G', 'tkUPbkhfJU', 'xh4Pj2yG79', 'zOBPFNtjG6', 'nlfPHxW0gw', 'jYvPT7D66L', 'vQxPNg5Va1'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, b8OPa0ptDmNZRs8a1D.cs High entropy of concatenated method names: 'yMBQuZx1tN', 'c0nQ2gq3Ti', 'bpyQEhSPSi', 'LIIQlRLJWf', 'YIQQbb7ly2', 'V5AQjkTChY', 'FkRQFfSYrk', 'tlHQHCv4v6', 'DJqQTqJOwS', 'nFAQNGM3b3'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, coAw41HW9K74cRgqAt.cs High entropy of concatenated method names: 'xCadMtcqxQ', 's8qdxD7g1u', 'RaAdKMstbX', 'pIsdR6b2NG', 'orFdo8AuaI', 'cYddX5M88T', 'i8Jd0MwTgE', 'Hsod66jcdN', 'YwbdasWrn9', 'F46dv83Xbf'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, jfuRhmRFSFcbJIi4WP.cs High entropy of concatenated method names: 'VhT9ieQqr3', 'CqM9DZKmvA', 'ToString', 'COQ9rguSSI', 'mUS9dINkow', 'ggE9y7PtBy', 'Kj99nUbt4a', 's5e9wyNOE6', 's3B9QH2QYT', 'f8Y9WLFfUy'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, SjnStH1RyS9c3mH92a.cs High entropy of concatenated method names: 'yLFMOA8WAAlNiD9amjl', 'Hy14R789odQie6v2opT', 'Uhdw5SXmBk', 'oWnwPMcY5A', 'gmUwLLnBPO', 'NZ5G3E8Y9D6ZK17Nng2', 'CUdHLE8Cn9xMvRwuE1M'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, mh2l126nvXkJPqinWr.cs High entropy of concatenated method names: 'x7a5rKFIRk', 'C3A5dPgPdM', 'GkX5yF7S3j', 'yEt5nm6DkN', 'WaE5w7F9Cw', 'Yfk5QB6gFl', 'quZ5Wu7I0v', 'DmO5Jb19Ah', 'beL5iK8Wsp', 'jf05DxnnIp'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, pvhWxLsdO1DVJwN9jq.cs High entropy of concatenated method names: 'XWmEmQX6M', 'v4YlVYaPb', 'BeXjDed6V', 'sEOF8dalU', 'b6wTRh61a', 'w3cNyomnx', 'mrhFRP01KAgA2yUNhb', 'HRewZLKZvRAueRXW5q', 'mRr591eEl', 'jZxLJy2Bf'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, WjkYcFaADDIrVYCSaV.cs High entropy of concatenated method names: 'RPn5moSJ3U', 'cjU51dDQC8', 'OOX5ty6d4N', 'bDq5GqWTMH', 'Rle5MDxjJo', 'va358bWPO1', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, SWahZnhhsOyUNFiqsqU.cs High entropy of concatenated method names: 'ToString', 'x8ALZjZ2pQ', 'IsgLYLe3sw', 'Qg2LC7koos', 'oWpLrUHxhm', 'MkqLdDfbBN', 'k5GLyNT9Ai', 'vlBLn5CdTh', 'STXP7Dt0PuWZR7YIp1H', 'GJDo6utKWpfA1JDfWbP'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, GhCMeWYfcmcjoFgkhc.cs High entropy of concatenated method names: 'hbshQoAw41', 'k9KhW74cRg', 'G74hiIHXde', 'ODAhDyuWaw', 'uKjhSBE6an', 'Wn1hfuaoM5', 'uBDnG9iGbOJqaJM3dT', 'G6YU2ywaqS39KNaKJZ', 'hu40pVTRMNbwmGEEf4', 'YePhhkRXxK'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, zYGaDtX4dK2rk9sZDn.cs High entropy of concatenated method names: 'cVl96CpqDM', 'bWo9vytyGg', 'QD35ejUB7J', 'CVl5hQfZrC', 'yGT9VNfLRc', 'zAW9cSuDQH', 'QML9BHZ7kp', 'ooA9McAuTc', 'uLs9xFebNw', 'LXm9KOXoI9'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, z6ivISdWp2AJ9wgyAj.cs High entropy of concatenated method names: 'Dispose', 'arqhaQkL3o', 'Jr0s1IJBay', 'uYUAAj2Dbe', 'Gihhv2l12n', 'YXkhzJPqin', 'ProcessDialogKey', 'kr0sejkYcF', 'tDDshIrVYC', 'oaVssQdI4X'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, MYCV8nMEqlsK44xms5.cs High entropy of concatenated method names: 'eVlSUlk4do', 'HqyScZAhNf', 'S9uSMMsRtf', 'dvXSxWu7vt', 'Aq8S10o4Zk', 'SWoSt20gRl', 'jSwSGHftHd', 'dukS8NkTfq', 'gflSgcPbC0', 'sP9SI4UbeT'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, HE2n9dW4U1DsdVPZZK.cs High entropy of concatenated method names: 'OoOZCA8E9j', 'xhaZrrQ4fu', 'k32Zdj6yvJ', 'xlKZy9uJrA', 'f0GZnSLUlP', 'nCGZwfZ8iA', 'se9ZQJJvOG', 'F61ZWXyA0j', 'UAAZJUUHlB', 'ChKZieQo9Y'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, Vj0JHiB7G6ybQSlcTY.cs High entropy of concatenated method names: 'ht2OHLqdaP', 'x9uOTA57No', 'huXOmZRwJL', 'j2xO1FIvAy', 'tejOGie39E', 'YowO8nEWtA', 'gqXOI8h56a', 'CmMO3uujtJ', 'Y9OOU5yEPv', 'L1wOV2DZrb'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, XvAgkWK92GpW3mdirl.cs High entropy of concatenated method names: 'ToString', 'L2GfV8xYEt', 'KcYf1oUkZK', 'X6eftY7HC7', 'HYhfGO9m3M', 'WiUf8MQPSa', 'JB3fgqRyA2', 'b12fIPpV6D', 'lOmf3SpnKO', 'cqKfpfMtPS'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, AMFGj7IDacdLWcWuGv.cs High entropy of concatenated method names: 'AfyQreieJn', 'sg5Qymp1pQ', 'dcKQwwN7V6', 'MAuwvtXBDG', 'ELvwzEFaUo', 'kquQecfcjR', 'ciBQhSYyNW', 'RptQsouRyf', 'riWQZD1HKG', 'hMCQYmA1Vi'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, jdI4XivoDg48OHO0PZ.cs High entropy of concatenated method names: 'f1SPhRb8JP', 'gZaPZXfpN1', 'b3xPYqcDFa', 'oZRPrOxViG', 'YAkPdMUSUX', 'LD4PnrmQkc', 'c4HPwiKmGk', 'mTf5093kOp', 'rar56AdJgh', 'tp75ayts8y'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, yWawNINotSqR24KjBE.cs High entropy of concatenated method names: 'zvEnbaejE8', 'Rf3nF4iNWZ', 'wnBytcd78B', 'qqhyGkplpF', 'Gg9y8MhoFl', 'bQjygKiEoD', 'LlQyIh5y4N', 'Yely3A851l', 'Ap9ypwAHpD', 'twJyUPC2fm'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, Xan0n1muaoM5hJxIYH.cs High entropy of concatenated method names: 'HxMwCNsxxK', 'jbTwdjFFJU', 'fViwnIdgcp', 'FrhwQuIH3L', 'EHjwWNGLQJ', 'iDjno2Ustq', 'mRfnXsSN9M', 'yvun0UhHAg', 'kYPn6F58iq', 'cwBnaEcbwW'
Source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.3781038.4.raw.unpack, tsbxymT74IHXdeVDAy.cs High entropy of concatenated method names: 'mjKylxf4J3', 'SPEyjUlYVm', 'i3ryHMiXKI', 'zGPyTWp6AR', 'vnmyS3M9WS', 'edsyf6F3Wo', 'VGIy98Cmuk', 'UT0y5TxGPV', 'rlqyPLRAR0', 'AkryLc3gFN'
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe File created: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe File created: C:\Users\user\AppData\Roaming\XClient.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xNgpESfQOvfb" /XML "C:\Users\user\AppData\Local\Temp\tmpA395.tmp"
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe PID: 672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: xNgpESfQOvfb.exe PID: 7084, type: MEMORYSTR
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Memory allocated: AD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Memory allocated: 2550000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Memory allocated: 4550000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Memory allocated: 8E30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Memory allocated: 7970000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Memory allocated: 9E30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Memory allocated: AE30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Memory allocated: 15D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Memory allocated: 2F70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Memory allocated: 4F70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Memory allocated: FE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Memory allocated: 2D20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Memory allocated: 2B40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Memory allocated: 8D80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Memory allocated: 9D80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Memory allocated: 9F80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Memory allocated: AF80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Memory allocated: 1340000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Memory allocated: 31E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Memory allocated: 2F50000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239874 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239764 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239654 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239546 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239437 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239328 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239218 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239080 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238968 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238859 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238750 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238640 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238531 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238421 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238312 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238203 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238093 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237984 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237875 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237765 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237656 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237546 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237436 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237328 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237218 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237088 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236968 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236817 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236568 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236453 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236302 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236186 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236065 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 235943 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 235812 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239828 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239715 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239609 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239500 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239391 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239264 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239156 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239047 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238937 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238828 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238719 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238609 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238500 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238391 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238025 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237907 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237782 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237657 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237532 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237407 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237295 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237188 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237063 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 236938 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 236766 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 236579 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 236438 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 236313 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Window / User API: threadDelayed 2706 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Window / User API: threadDelayed 3563 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 9086 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 353 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7372 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Window / User API: threadDelayed 7297 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Window / User API: threadDelayed 2510 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Window / User API: threadDelayed 1786 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Window / User API: threadDelayed 3561 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -18446744073709540s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -239874s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -239764s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -239654s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -239546s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -239437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -239328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -239218s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -239080s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -238968s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -238859s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -238750s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -238640s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -238531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -238421s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -238312s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -238203s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -238093s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -237984s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -237875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -237765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -237656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -237546s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -237436s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -237328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -237218s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -237088s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -236968s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -236817s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -236568s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -236453s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -236302s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -236186s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -236065s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -235943s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 6856 Thread sleep time: -235812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 2744 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 416 Thread sleep count: 9086 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5480 Thread sleep count: 353 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4884 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6324 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7092 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5228 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe TID: 2524 Thread sleep time: -16602069666338586s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -14757395258967632s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -239828s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -239715s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -239609s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -239500s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -239391s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -239264s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -239156s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -239047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -238937s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -238828s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -238719s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -238609s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -238500s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -238391s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -238025s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -237907s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -237782s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -237657s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -237532s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -237407s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -237295s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -237188s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -237063s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -236938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -236766s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -236579s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -236438s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 4344 Thread sleep time: -236313s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 3420 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe TID: 5972 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239874 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239764 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239654 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239546 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239437 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239328 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239218 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 239080 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238968 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238859 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238750 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238640 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238531 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238421 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238312 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238203 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 238093 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237984 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237875 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237765 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237656 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237546 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237436 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237328 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237218 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 237088 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236968 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236817 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236568 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236453 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236302 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236186 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 236065 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 235943 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 235812 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239828 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239715 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239609 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239500 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239391 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239264 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239156 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 239047 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238937 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238828 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238719 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238609 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238500 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238391 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 238025 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237907 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237782 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237657 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237532 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237407 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237295 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237188 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 237063 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 236938 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 236766 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 236579 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 236438 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 236313 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Thread delayed: delay time: 922337203685477
Source: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe, 00000009.00000002.4641371042.0000000006AC4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllAO,
Source: xNgpESfQOvfb.exe, 0000000A.00000002.2267710024.00000000078EB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _NECVMWar&Prod_VMware_SA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Memory written: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xNgpESfQOvfb" /XML "C:\Users\user\AppData\Local\Temp\tmpA395.tmp" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe "C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xNgpESfQOvfb" /XML "C:\Users\user\AppData\Local\Temp\tmp9832.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process created: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe "C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Process created: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe "C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Queries volume information: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Queries volume information: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\xNgpESfQOvfb.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information
barindex
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.7060000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.7060000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d51004.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d51004.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2209442377.0000000007060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2263227779.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2200717075.0000000002551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected XWorm
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d8f19c.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d99478.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.xNgpESfQOvfb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d99478.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d51004.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d8f19c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.2297610217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2263227779.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2200717075.0000000002551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4633950904.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe PID: 672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe PID: 5332, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: xNgpESfQOvfb.exe PID: 7084, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: xNgpESfQOvfb.exe PID: 380, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.7060000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.7060000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d51004.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d51004.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2209442377.0000000007060000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2263227779.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2200717075.0000000002551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected XWorm
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d8f19c.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d99478.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.xNgpESfQOvfb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25c947c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25bf1a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe.25810d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d99478.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d51004.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.xNgpESfQOvfb.exe.2d8f19c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.2297610217.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2263227779.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2200717075.0000000002551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4633950904.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe PID: 672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe PID: 5332, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: xNgpESfQOvfb.exe PID: 7084, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: xNgpESfQOvfb.exe PID: 380, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1476041 Sample: SecuriteInfo.com.TrojanLoad... Startdate: 18/07/2024 Architecture: WINDOWS Score: 100 51 moneymaker-30608.portmap.host 2->51 57 Snort IDS alert for network traffic 2->57 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 18 other signatures 2->63 8 SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe 7 2->8         started        12 xNgpESfQOvfb.exe 5 2->12         started        signatures3 process4 file5 41 C:\Users\user\AppData\...\xNgpESfQOvfb.exe, PE32 8->41 dropped 43 C:\Users\...\xNgpESfQOvfb.exe:Zone.Identifier, ASCII 8->43 dropped 45 C:\Users\user\AppData\Local\...\tmpA395.tmp, XML 8->45 dropped 47 SecuriteInfo.com.T....29424.1974.exe.log, ASCII 8->47 dropped 65 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->65 67 Uses schtasks.exe or at.exe to add and modify task schedules 8->67 69 Adds a directory exclusion to Windows Defender 8->69 14 SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.29424.1974.exe 6 8->14         started        18 powershell.exe 23 8->18         started        21 powershell.exe 23 8->21         started        23 schtasks.exe 1 8->23         started        71 Multi AV Scanner detection for dropped file 12->71 73 Machine Learning detection for dropped file 12->73 75 Injects a PE file into a foreign processes 12->75 25 schtasks.exe 12->25         started        27 xNgpESfQOvfb.exe 12->27         started        29 xNgpESfQOvfb.exe 12->29         started        signatures6 process7 dnsIp8 53 moneymaker-30608.portmap.host 193.161.193.99, 30608, 49717 BITREE-ASRU Russian Federation 14->53 49 C:\Users\user\AppData\Roaming\XClient.exe, PE32 14->49 dropped 55 Loading BitLocker PowerShell Module 18->55 31 conhost.exe 18->31         started        33 WmiPrvSE.exe 18->33         started        35 conhost.exe 21->35         started        37 conhost.exe 23->37         started        39 conhost.exe 25->39         started        file9 signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
193.161.193.99
 moneymaker-30608.portmap.host Russian Federation
198134 BITREE-ASRU true

Contacted Domains

Name IP Active
moneymaker-30608.portmap.host 193.161.193.99 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
moneymaker-30608.portmap.host true
  • Avira URL Cloud: phishing
 unknown