Windows Analysis Report
SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe

Overview

General Information

Sample name: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe
Analysis ID: 1545319
MD5: a9a01bcaf4ffeddb26fd9fc79f0b57c4
SHA1: becb33e475352ad604ea851038cec53d2d15b047
SHA256: 64be2f3a38522ca4b5f4d7887cd5832363f00d1a07b8bb531424bf6e81939fce
Tags: exe
Infos:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
Drops executable to a common third party application directory
Found pyInstaller with non standard icon
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the windows firewall
PE file contains section with special chars
PE file has nameless sections
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses netsh to modify the Windows network and firewall settings
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Potential browser exploit detected (process start blacklist hit)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Powershell Defender Exclusion
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Avira: detected
Antivirus detection for dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Avira: detection malicious, Label: TR/AVI.Agent.rrfxm
Source: C:\ProgramData\Microsoft\Bound.exe Avira: detection malicious, Label: TR/AVI.Agent.lvnlf
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\Microsoft\Bound.exe ReversingLabs: Detection: 62%
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe ReversingLabs: Detection: 58%
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe ReversingLabs: Detection: 42%
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe ReversingLabs: Detection: 62%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 98.1% probability
Machine Learning detection for dropped file
Source: C:\ProgramData\Microsoft\Bound.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: API-MS-Win-Core-Util-L1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.15.dr
Source: Binary string: API-MS-Win-Core-DateTime-L1-1-0.pdb source: api-ms-win-core-datetime-l1-1-0.dll.15.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\_hashlib.pdb source: _hashlib.pyd.15.dr
Source: Binary string: MlcrosoftEdgeUpdate.pdb source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: C:\Windows\MlcrosoftEdgeUpdate.pdbpdbate.pdbw source: MicrosoftEdgeUpdate.exe, 0000000E.00000002.2210782859.000001B9FFDEC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: API-MS-Win-Core-Handle-L1-1-0.pdb3 source: api-ms-win-core-handle-l1-1-0.dll.15.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\_socket.pdb source: _socket.pyd.15.dr
Source: Binary string: System.ni.pdbRSDS source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: C:\codes\bound\KillDefender\obj\Debug\MlcrosoftEdgeUpdate.pdb source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe, 00000000.00000002.2238150261.0000021C1D86E000.00000004.00000800.00020000.00000000.sdmp, Bound.exe, 00000012.00000000.1960600687.00000212527C2000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.15.dr
Source: Binary string: API-MS-Win-Core-NamedPipe-L1-1-0.pdb3 source: api-ms-win-core-namedpipe-l1-1-0.dll.15.dr
Source: Binary string: API-MS-Win-Core-ProcessEnvironment-L1-1-0.pdb source: api-ms-win-core-processenvironment-l1-1-0.dll.15.dr
Source: Binary string: mscorlib.ni.pdbRSDS7^3l source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: API-MS-Win-Core-DateTime-L1-1-0.pdb3 source: api-ms-win-core-datetime-l1-1-0.dll.15.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.15.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.15.dr
Source: Binary string: API-MS-Win-Core-ProcessEnvironment-L1-1-0.pdb3 source: api-ms-win-core-processenvironment-l1-1-0.dll.15.dr
Source: Binary string: System.pdb source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: API-MS-Win-Core-NamedPipe-L1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.15.dr
Source: Binary string: System.Core.ni.pdb source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: API-MS-Win-Core-Util-L1-1-0.pdb3 source: api-ms-win-core-util-l1-1-0.dll.15.dr
Source: Binary string: API-MS-Win-Core-Handle-L1-1-0.pdb source: api-ms-win-core-handle-l1-1-0.dll.15.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\select.pdb source: select.pyd.15.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\_elementtree.pdb source: _elementtree.pyd.15.dr
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.15.dr
Source: Binary string: mscorlib.pdb source: MicrosoftEdgeUpdate.exe, 0000000E.00000002.2200183352.000001B9E751E000.00000004.00000800.00020000.00000000.sdmp, WERF1FE.tmp.dmp.22.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\python37.pdb source: python37.dll.15.dr
Source: Binary string: C:\codes\start\KillDefender\obj\Debug\MlcrosoftEdgeUpdate.pdb.-H- :-_CorExeMainmscoree.dll source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe, 00000000.00000002.2238150261.0000021C1D872000.00000004.00000800.00020000.00000000.sdmp, MicrosoftEdgeUpdate.exe, 0000000E.00000002.2210782859.000001B9FFDEC000.00000004.00000020.00020000.00000000.sdmp, MicrosoftEdgeUpdate.exe, 0000000E.00000000.1954911715.000001B9E5942000.00000002.00000001.01000000.00000008.sdmp, MicrosoftEdgeUpdate.exe, 0000000E.00000002.2200183352.000001B9E751E000.00000004.00000800.00020000.00000000.sdmp, MicrosoftEdgeUpdate.exe.0.dr
Source: Binary string: C:\codes\start\KillDefender\obj\Debug\MlcrosoftEdgeUpdate.pdb source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe, 00000000.00000002.2238150261.0000021C1D872000.00000004.00000800.00020000.00000000.sdmp, MicrosoftEdgeUpdate.exe, 0000000E.00000002.2210782859.000001B9FFDEC000.00000004.00000020.00020000.00000000.sdmp, MicrosoftEdgeUpdate.exe, 0000000E.00000000.1954911715.000001B9E5942000.00000002.00000001.01000000.00000008.sdmp, MicrosoftEdgeUpdate.exe, 0000000E.00000002.2200183352.000001B9E751E000.00000004.00000800.00020000.00000000.sdmp, MicrosoftEdgeUpdate.exe.0.dr
Source: Binary string: mscorlib.ni.pdb source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\_ctypes.pdb source: _ctypes.pyd.15.dr
Source: Binary string: System.Core.pdb source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: System.ni.pdb source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WERF1FE.tmp.dmp.22.dr
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\ProgramData\Microsoft\Bound.exe Code function: 4x nop then jmp 00007FFD9BAD0CCBh 18_2_00007FFD9BAD0488
Source: C:\ProgramData\Microsoft\Bound.exe Code function: 4x nop then jmp 00007FFD9BAD0CCBh 18_2_00007FFD9BAD0AAD
Potential browser exploit detected (process start blacklist hit)
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Process created: C:\Windows\System32\conhost.exe

Networking
barindex
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: nt89s.kro.kr replaycode: Name error (3)
Source: unknown DNS traffic detected: query: nt89.kro.kr replaycode: Name error (3)
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: nt89s.kro.kr
Source: global traffic DNS traffic detected: DNS query: nt89.kro.kr
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: cv2.pyd.15.dr String found in binary or memory: http://caffe.berkeleyvision.org
Source: cv2.pyd.15.dr String found in binary or memory: http://caffe.berkeleyvision.org/)
Source: cv2.pyd.15.dr String found in binary or memory: http://campar.in.tum.de/Chair/HandEyeCalibration).
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: powershell.exe, 0000001E.00000002.2218905322.0000019EDE230000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.v
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: cv2.pyd.15.dr String found in binary or memory: http://homepages.inf.ed.ac.uk/rbf/HIPR2/hough.htm
Source: powershell.exe, 00000002.00000002.1897044803.000002083316F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000002.00000002.1839674107.0000020823329000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: _sfc64.cp37-win32.pyd.15.dr String found in binary or memory: http://pracrand.sourceforge.net/RNG_engines.txt
Source: python37.dll.15.dr String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: powershell.exe, 00000002.00000002.1839674107.0000020823329000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.1839674107.0000020823101000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1999026288.00000274535BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2075247518.000001D613313000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2162722138.0000019EC62B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2273918965.000001FBD8E07000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1839674107.0000020823329000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: cv2.pyd.15.dr String found in binary or memory: http://torch.ch
Source: cv2.pyd.15.dr String found in binary or memory: http://torch.ch/)
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: cv2.pyd.15.dr String found in binary or memory: http://underdestruction.com/2004/02/25/stackblur-2004.
Source: Amcache.hve.22.dr String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 00000002.00000002.1839674107.0000020823329000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: cv2.pyd.15.dr String found in binary or memory: http://www.dai.ed.ac.uk/CVonline/LOCAL_COPIES/MANDUCHI1/Bilateral_Filtering.html
Source: cv2.pyd.15.dr String found in binary or memory: http://www.gdal.org)
Source: cv2.pyd.15.dr String found in binary or memory: http://www.gdal.org/formats_list.html)
Source: cv2.pyd.15.dr String found in binary or memory: http://www.gdal.org/ogr_formats.html).
Source: cv2.pyd.15.dr String found in binary or memory: http://www.ipol.im/pub/algo/bcm_non_local_means_denoising
Source: cv2.pyd.15.dr String found in binary or memory: http://www.ipol.im/pub/algo/bcm_non_local_means_denoising/
Source: _multiarray_umath.cp37-win32.pyd.15.dr String found in binary or memory: http://www.math.sfu.ca/~cbm/aands/
Source: _multiarray_umath.cp37-win32.pyd.15.dr String found in binary or memory: http://www.math.sfu.ca/~cbm/aands/page_69.htm
Source: bit_generator.cp37-win32.pyd.15.dr String found in binary or memory: http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.html
Source: _sfc64.cp37-win32.pyd.15.dr String found in binary or memory: http://www.pcg-random.org/posts/random-invertible-mapping-statistics.html
Source: powershell.exe, 00000002.00000002.1839674107.0000020823101000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1999026288.000002745359C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1999026288.000002745356F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2075247518.000001D61334D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2075247518.000001D613339000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2162722138.0000019EC628D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2162722138.0000019EC6270000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2273918965.000001FBD8DDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2273918965.000001FBD8DC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: cv2.pyd.15.dr String found in binary or memory: https://arxiv.org/abs/1704.04503
Source: powershell.exe, 00000002.00000002.1897044803.000002083316F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.1897044803.000002083316F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.1897044803.000002083316F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: bit_generator.cp37-win32.pyd.15.dr String found in binary or memory: https://gist.github.com/imneme/540829265469e673d045
Source: cv2.pyd.15.dr String found in binary or memory: https://github.com/NVIDIA/caffe.
Source: powershell.exe, 00000002.00000002.1839674107.0000020823329000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: cv2.pyd.15.dr String found in binary or memory: https://github.com/opencv/opencv/issues/16739
Source: cv2.pyd.15.dr String found in binary or memory: https://github.com/opencv/opencv/issues/16739cv::MatOp_AddEx::assign4g
Source: cv2.pyd.15.dr String found in binary or memory: https://github.com/opencv/opencv/issues/23152.
Source: cv2.pyd.15.dr String found in binary or memory: https://github.com/opencv/opencv/issues/5412.
Source: cv2.pyd.15.dr String found in binary or memory: https://github.com/opencv/opencv/issues/6293
Source: cv2.pyd.15.dr String found in binary or memory: https://github.com/opencv/opencv/issues/6293u-
Source: cv2.pyd.15.dr String found in binary or memory: https://github.com/openvinotoolkit/open_model_zoo/blob/master/models/public/yolo-v2-tiny-tf/yolo-v2-
Source: cv2.pyd.15.dr String found in binary or memory: https://github.com/torch/nn/blob/master/doc/module.md
Source: powershell.exe, 00000002.00000002.1897044803.000002083316F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: __init__.py4.15.dr String found in binary or memory: https://numpy.org/doc/stable/user/basics.subclassing.html
Source: cv2.pyd.15.dr String found in binary or memory: https://onnx.ai/
Source: cv2.pyd.15.dr String found in binary or memory: https://onnx.ai/)
Source: cv2.pyd.15.dr String found in binary or memory: https://pjreddie.com/darknet/
Source: cv2.pyd.15.dr String found in binary or memory: https://pjreddie.com/darknet/)
Source: cv2.pyd.15.dr String found in binary or memory: https://software.intel.com/openvino-toolkit)
Source: cv2.pyd.15.dr String found in binary or memory: https://static.aminer.org/pdf/PDF/000/317/196/spatio_temporal_wiener_filtering_of_image_sequences_us
Source: select.pyd.15.dr, _socket.pyd.15.dr, _hashlib.pyd.15.dr, python37.dll.15.dr, _ctypes.pyd.15.dr, _elementtree.pyd.15.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: cv2.pyd.15.dr String found in binary or memory: https://www.learnopencv.com/convex-hull-using-opencv-in-python-and-c/
Source: cv2.pyd.15.dr String found in binary or memory: https://www.learnopencv.com/convex-hull-using-opencv-in-python-and-c/nativeVectorWidthIntdecode(img
Source: cv2.pyd.15.dr String found in binary or memory: https://www.tensorflow.org/
Source: cv2.pyd.15.dr String found in binary or memory: https://www.tensorflow.org/)
Source: cv2.pyd.15.dr String found in binary or memory: https://www.tensorflow.org/lite

System Summary
barindex
PE file contains section with special chars
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Static PE information: section name: =0aP
PE file has nameless sections
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Static PE information: section name:
One or more processes crash
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 280 -s 1376
PE file contains more sections than normal
Source: opencv_videoio_ffmpeg480.dll.15.dr Static PE information: Number of sections : 11 > 10
Source: libopenblas.VTYUM5MXKVFE4PZZER3L7PNO6YB4XFF3.gfortran-win32.dll.15.dr Static PE information: Number of sections : 18 > 10
PE file does not import any functions
Source: api-ms-win-core-file-l2-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: python3.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.15.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe, 00000000.00000002.2238150261.0000021C1D872000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMlcrosoftEdgeUpdate.exeH vs SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe, 00000000.00000000.1697839610.0000021C1BB52000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameinstaller1.exe6 vs SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe, 00000000.00000002.2238150261.0000021C1D86E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMlcrosoftEdgeUpdate.exeH vs SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engine Classification label: mal100.troj.evad.winEXE@55/112@18/1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3760:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess280
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:772:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6200:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6432:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4936:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7136:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6784:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6180:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1352:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe File created: C:\Users\user\AppData\Local\Temp\selfdelete.bat Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\selfdelete.bat""
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe ReversingLabs: Detection: 62%
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft';Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Internet Explorer'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachineCore{53F2EB3B-2C85-ABAA-BD9C-FC4F0859F018}" /f
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachineCore{53F2EB3B-2C85-ABAA-BD9C-FC4F0859F018}" /f
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c schtasks /create /tn "MicrosoftEdgeUpdateTaskMachineCore{53F2EB3B-2C85-ABAB-BD9C-FC4F0859F018}" /tr "\"C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe\"" /sc onlogon /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "MicrosoftEdgeUpdateTaskMachineCore{53F2EB3B-2C85-ABAB-BD9C-FC4F0859F018}" /tr "\"C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe\"" /sc onlogon /rl HIGHEST /f
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe "C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe"
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process created: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe "C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe"
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\ProgramData\Microsoft\Bound.exe "C:\ProgramData\Microsoft\Bound.exe"
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "netsh advfirewall firewall delete rule name=all dir=in program='C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 280 -s 1376
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name=all dir=in "program=C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\selfdelete.bat""
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Process created: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe "C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe"
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "netsh advfirewall firewall delete rule name=all dir=out program='C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name=all dir=out "program=C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe"
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "netsh advfirewall firewall add rule name='Allow Internet Explorer Inbound' dir=in action=allow program='C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe' enable=yes profile=private,public"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule "name=Allow Internet Explorer Inbound" dir=in action=allow "program=C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe" enable=yes profile=private,public
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "netsh advfirewall firewall add rule name='Allow Internet Explorer Outbound' dir=out action=allow program='C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe' enable=yes profile=private,public"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule "name=Allow Internet Explorer Outbound" dir=out action=allow "program=C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe" enable=yes profile=private,public
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp8B5F.tmp.bat""
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft';Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Internet Explorer'" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachineCore{53F2EB3B-2C85-ABAA-BD9C-FC4F0859F018}" /f Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c schtasks /create /tn "MicrosoftEdgeUpdateTaskMachineCore{53F2EB3B-2C85-ABAB-BD9C-FC4F0859F018}" /tr "\"C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe\"" /sc onlogon /rl HIGHEST /f Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe "C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\ProgramData\Microsoft\Bound.exe "C:\ProgramData\Microsoft\Bound.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\selfdelete.bat"" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachineCore{53F2EB3B-2C85-ABAA-BD9C-FC4F0859F018}" /f Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "MicrosoftEdgeUpdateTaskMachineCore{53F2EB3B-2C85-ABAB-BD9C-FC4F0859F018}" /tr "\"C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe\"" /sc onlogon /rl HIGHEST /f Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process created: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe "C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe" Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Process created: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe "C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe" Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "netsh advfirewall firewall delete rule name=all dir=in program='C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe'" Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "netsh advfirewall firewall delete rule name=all dir=out program='C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe'" Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "netsh advfirewall firewall add rule name='Allow Internet Explorer Inbound' dir=in action=allow program='C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe' enable=yes profile=private,public" Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "netsh advfirewall firewall add rule name='Allow Internet Explorer Outbound' dir=out action=allow program='C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe' enable=yes profile=private,public" Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp8B5F.tmp.bat"" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name=all dir=in "program=C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name=all dir=out "program=C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule "name=Allow Internet Explorer Inbound" dir=in action=allow "program=C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe" enable=yes profile=private,public
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule "name=Allow Internet Explorer Outbound" dir=out action=allow "program=C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe" enable=yes profile=private,public
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: wldp.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: propsys.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: profapi.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: edputil.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: netutils.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: slc.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: userenv.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: sppc.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Section loaded: version.dll Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: apphelp.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: version.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: vcruntime140.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: cryptsp.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: rsaenh.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: cryptbase.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: libopenblas.vtyum5mxkvfe4pzzer3l7pno6yb4xff3.gfortran-win32.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: libcrypto-1_1.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: wsock32.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: mfplat.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: mf.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: mfreadwrite.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: dxgi.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: d3d11.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: mfcore.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: powrprof.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: ksuser.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: mfperfhelper.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: rtworkq.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: umpdc.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: pdh.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: iphlpapi.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: wtsapi32.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: mswsock.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: dnsapi.dll
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winipsec.dll
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Static file information: File size 42137088 > 1048576
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Static PE information: Raw size of =0aP is bigger than: 0x100000 < 0x2825e00
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: API-MS-Win-Core-Util-L1-1-0.pdb source: api-ms-win-core-util-l1-1-0.dll.15.dr
Source: Binary string: API-MS-Win-Core-DateTime-L1-1-0.pdb source: api-ms-win-core-datetime-l1-1-0.dll.15.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\_hashlib.pdb source: _hashlib.pyd.15.dr
Source: Binary string: MlcrosoftEdgeUpdate.pdb source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: C:\Windows\MlcrosoftEdgeUpdate.pdbpdbate.pdbw source: MicrosoftEdgeUpdate.exe, 0000000E.00000002.2210782859.000001B9FFDEC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: API-MS-Win-Core-Handle-L1-1-0.pdb3 source: api-ms-win-core-handle-l1-1-0.dll.15.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\_socket.pdb source: _socket.pyd.15.dr
Source: Binary string: System.ni.pdbRSDS source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: C:\codes\bound\KillDefender\obj\Debug\MlcrosoftEdgeUpdate.pdb source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe, 00000000.00000002.2238150261.0000021C1D86E000.00000004.00000800.00020000.00000000.sdmp, Bound.exe, 00000012.00000000.1960600687.00000212527C2000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: api-ms-win-crt-filesystem-l1-1-0.dll.15.dr
Source: Binary string: API-MS-Win-Core-NamedPipe-L1-1-0.pdb3 source: api-ms-win-core-namedpipe-l1-1-0.dll.15.dr
Source: Binary string: API-MS-Win-Core-ProcessEnvironment-L1-1-0.pdb source: api-ms-win-core-processenvironment-l1-1-0.dll.15.dr
Source: Binary string: mscorlib.ni.pdbRSDS7^3l source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: API-MS-Win-Core-DateTime-L1-1-0.pdb3 source: api-ms-win-core-datetime-l1-1-0.dll.15.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.15.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: api-ms-win-core-localization-l1-2-0.dll.15.dr
Source: Binary string: API-MS-Win-Core-ProcessEnvironment-L1-1-0.pdb3 source: api-ms-win-core-processenvironment-l1-1-0.dll.15.dr
Source: Binary string: System.pdb source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: API-MS-Win-Core-NamedPipe-L1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.15.dr
Source: Binary string: System.Core.ni.pdb source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: API-MS-Win-Core-Util-L1-1-0.pdb3 source: api-ms-win-core-util-l1-1-0.dll.15.dr
Source: Binary string: API-MS-Win-Core-Handle-L1-1-0.pdb source: api-ms-win-core-handle-l1-1-0.dll.15.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\select.pdb source: select.pyd.15.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\_elementtree.pdb source: _elementtree.pyd.15.dr
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: api-ms-win-core-timezone-l1-1-0.dll.15.dr
Source: Binary string: mscorlib.pdb source: MicrosoftEdgeUpdate.exe, 0000000E.00000002.2200183352.000001B9E751E000.00000004.00000800.00020000.00000000.sdmp, WERF1FE.tmp.dmp.22.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\python37.pdb source: python37.dll.15.dr
Source: Binary string: C:\codes\start\KillDefender\obj\Debug\MlcrosoftEdgeUpdate.pdb.-H- :-_CorExeMainmscoree.dll source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe, 00000000.00000002.2238150261.0000021C1D872000.00000004.00000800.00020000.00000000.sdmp, MicrosoftEdgeUpdate.exe, 0000000E.00000002.2210782859.000001B9FFDEC000.00000004.00000020.00020000.00000000.sdmp, MicrosoftEdgeUpdate.exe, 0000000E.00000000.1954911715.000001B9E5942000.00000002.00000001.01000000.00000008.sdmp, MicrosoftEdgeUpdate.exe, 0000000E.00000002.2200183352.000001B9E751E000.00000004.00000800.00020000.00000000.sdmp, MicrosoftEdgeUpdate.exe.0.dr
Source: Binary string: C:\codes\start\KillDefender\obj\Debug\MlcrosoftEdgeUpdate.pdb source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe, 00000000.00000002.2238150261.0000021C1D872000.00000004.00000800.00020000.00000000.sdmp, MicrosoftEdgeUpdate.exe, 0000000E.00000002.2210782859.000001B9FFDEC000.00000004.00000020.00020000.00000000.sdmp, MicrosoftEdgeUpdate.exe, 0000000E.00000000.1954911715.000001B9E5942000.00000002.00000001.01000000.00000008.sdmp, MicrosoftEdgeUpdate.exe, 0000000E.00000002.2200183352.000001B9E751E000.00000004.00000800.00020000.00000000.sdmp, MicrosoftEdgeUpdate.exe.0.dr
Source: Binary string: mscorlib.ni.pdb source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: C:\A\18\s\PCbuild\win32\_ctypes.pdb source: _ctypes.pyd.15.dr
Source: Binary string: System.Core.pdb source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: System.ni.pdb source: WERF1FE.tmp.dmp.22.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WERF1FE.tmp.dmp.22.dr

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Unpacked PE file: 0.2.SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe.21c19320000.0.unpack =0aP:EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;
Binary contains a suspicious time stamp
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Static PE information: 0xCF2C0F01 [Wed Feb 21 19:58:57 2080 UTC]
PE file contains sections with non-standard names
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Static PE information: section name: =0aP
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Static PE information: section name:
Source: VCRUNTIME140.dll.15.dr Static PE information: section name: _RDATA
Source: opencv_videoio_ffmpeg480.dll.15.dr Static PE information: section name: .rodata
Source: libcrypto-1_1.dll.15.dr Static PE information: section name: .00cfg
Source: libopenblas.VTYUM5MXKVFE4PZZER3L7PNO6YB4XFF3.gfortran-win32.dll.15.dr Static PE information: section name: /4
Source: libopenblas.VTYUM5MXKVFE4PZZER3L7PNO6YB4XFF3.gfortran-win32.dll.15.dr Static PE information: section name: /14
Source: libopenblas.VTYUM5MXKVFE4PZZER3L7PNO6YB4XFF3.gfortran-win32.dll.15.dr Static PE information: section name: /29
Source: libopenblas.VTYUM5MXKVFE4PZZER3L7PNO6YB4XFF3.gfortran-win32.dll.15.dr Static PE information: section name: /41
Source: libopenblas.VTYUM5MXKVFE4PZZER3L7PNO6YB4XFF3.gfortran-win32.dll.15.dr Static PE information: section name: /55
Source: libopenblas.VTYUM5MXKVFE4PZZER3L7PNO6YB4XFF3.gfortran-win32.dll.15.dr Static PE information: section name: /67
Source: libopenblas.VTYUM5MXKVFE4PZZER3L7PNO6YB4XFF3.gfortran-win32.dll.15.dr Static PE information: section name: /80
Source: libopenblas.VTYUM5MXKVFE4PZZER3L7PNO6YB4XFF3.gfortran-win32.dll.15.dr Static PE information: section name: /91
Source: libopenblas.VTYUM5MXKVFE4PZZER3L7PNO6YB4XFF3.gfortran-win32.dll.15.dr Static PE information: section name: /102
Source: libssl-1_1.dll.15.dr Static PE information: section name: .00cfg
Source: cv2.pyd.15.dr Static PE information: section name: IPPCODE
Source: cv2.pyd.15.dr Static PE information: section name: _RDATA
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD9B98D2A5 pushad ; iretd 2_2_00007FFD9B98D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD9BAA83D3 push cs; iretd 2_2_00007FFD9BAA841A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD9BAA8AAC push eax; iretd 2_2_00007FFD9BAA8ABA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD9BAA20A8 push E95EAFD2h; ret 2_2_00007FFD9BAA20E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFD9BB72316 push 8B485F94h; iretd 2_2_00007FFD9BB7231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 20_2_00007FFD9BAC27D4 push ebp; retf 20_2_00007FFD9BAC2832
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 27_2_00007FFD9BAB19BA pushad ; ret 27_2_00007FFD9BAB19C9

Persistence and Installation Behavior
barindex
Drops executable to a common third party application directory
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe File written: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Jump to behavior
Found pyInstaller with non standard icon
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Process created: "C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe"
Drops PE files
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe File created: C:\ProgramData\Microsoft\Bound.exe Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\libopenblas.VTYUM5MXKVFE4PZZER3L7PNO6YB4XFF3.gfortran-win32.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\_hashlib.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\core\_multiarray_tests.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\ucrtbase.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\unicodedata.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\_ctypes.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\_socket.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\linalg\lapack_lite.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\opencv_videoio_ffmpeg480.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_bounded_integers.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\pyexpat.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\mtrand.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\linalg\_umath_linalg.cp37-win32.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe File created: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_mt19937.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\fft\_pocketfft_internal.cp37-win32.pyd Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe File created: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\bit_generator.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\netifaces.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\python37.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_common.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\python3.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\_lzma.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\cv2.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\libcrypto-1_1.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_sfc64.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\VCRUNTIME140.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\_bz2.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\core\_multiarray_umath.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\_ssl.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\select.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_pcg64.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_generator.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\libssl-1_1.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_philox.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\_elementtree.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe File created: C:\ProgramData\Microsoft\Bound.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe File created: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe File created: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachineCore{53F2EB3B-2C85-ABAA-BD9C-FC4F0859F018}" /f

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Uses ping.exe to sleep
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Memory allocated: 21C1BE90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Memory allocated: 21C357E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Memory allocated: 21C3E140000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Memory allocated: 1B9E5C80000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Memory allocated: 1B9FF4B0000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Memory allocated: 21252AF0000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Memory allocated: 2126C4F0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Window / User API: threadDelayed 1222 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Window / User API: threadDelayed 853 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5739 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3971 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1417 Jump to behavior
Source: C:\Windows\System32\conhost.exe Window / User API: threadDelayed 2561
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 539
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 764
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1803
Found dropped PE file which has not been started or loaded
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\_hashlib.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\core\_multiarray_tests.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\unicodedata.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\_ctypes.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\_socket.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\linalg\lapack_lite.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_bounded_integers.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\opencv_videoio_ffmpeg480.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\pyexpat.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\mtrand.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\linalg\_umath_linalg.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_mt19937.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\psutil\_psutil_windows.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\fft\_pocketfft_internal.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\bit_generator.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\netifaces.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_common.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\python37.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\_lzma.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\cv2.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\python3.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_sfc64.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\_bz2.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\core\_multiarray_umath.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\_ssl.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\select.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_pcg64.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_generator.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\libssl-1_1.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_philox.cp37-win32.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\_elementtree.pyd Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI55002\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe TID: 5100 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe TID: 6932 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5968 Thread sleep count: 5739 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5968 Thread sleep count: 3971 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2536 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe TID: 5476 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3052 Thread sleep count: 1417 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4268 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7048 Thread sleep count: 539 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5236 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4484 Thread sleep count: 764 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6880 Thread sleep count: 127 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3520 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3260 Thread sleep count: 1803 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5676 Thread sleep count: 100 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1168 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: Amcache.hve.22.dr Binary or memory string: VMware
Source: SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Binary or memory string: #(VmCIJ
Source: Amcache.hve.22.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.22.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.22.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.22.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.22.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.22.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.22.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.22.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.22.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.22.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.22.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: netsh.exe, 0000001D.00000002.2060794340.000002BF320C7000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000001D.00000003.2059762065.000002BF320C4000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000020.00000003.2143575388.000001C2804D5000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000023.00000003.2252352867.0000017EA7EA5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.22.dr Binary or memory string: vmci.sys
Source: Amcache.hve.22.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.22.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.22.dr Binary or memory string: \driver\vmci,\driver\pci
Source: netsh.exe, 00000017.00000002.1979187876.0000023570068000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.
Source: Amcache.hve.22.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.22.dr Binary or memory string: VMware20,1
Source: Amcache.hve.22.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.22.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.22.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.22.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.22.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.22.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.22.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.22.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.22.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.22.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.22.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process queried: DebugPort Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process queried: DebugPort Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Process token adjusted: Debug
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft';Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Internet Explorer'"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft';Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Internet Explorer'" Jump to behavior
Bypasses PowerShell execution policy
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft';Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Internet Explorer'"
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft';Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Internet Explorer'" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachineCore{53F2EB3B-2C85-ABAA-BD9C-FC4F0859F018}" /f Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c schtasks /create /tn "MicrosoftEdgeUpdateTaskMachineCore{53F2EB3B-2C85-ABAB-BD9C-FC4F0859F018}" /tr "\"C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe\"" /sc onlogon /rl HIGHEST /f Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe "C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\ProgramData\Microsoft\Bound.exe "C:\ProgramData\Microsoft\Bound.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\selfdelete.bat"" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachineCore{53F2EB3B-2C85-ABAA-BD9C-FC4F0859F018}" /f Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "MicrosoftEdgeUpdateTaskMachineCore{53F2EB3B-2C85-ABAB-BD9C-FC4F0859F018}" /tr "\"C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe\"" /sc onlogon /rl HIGHEST /f Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Process created: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe "C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe" Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Process created: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe "C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe" Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "netsh advfirewall firewall delete rule name=all dir=in program='C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe'" Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "netsh advfirewall firewall delete rule name=all dir=out program='C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe'" Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "netsh advfirewall firewall add rule name='Allow Internet Explorer Inbound' dir=in action=allow program='C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe' enable=yes profile=private,public" Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "netsh advfirewall firewall add rule name='Allow Internet Explorer Outbound' dir=out action=allow program='C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe' enable=yes profile=private,public" Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp8B5F.tmp.bat"" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name=all dir=in "program=C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name=all dir=out "program=C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule "name=Allow Internet Explorer Inbound" dir=in action=allow "program=C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe" enable=yes profile=private,public
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule "name=Allow Internet Explorer Outbound" dir=out action=allow "program=C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe" enable=yes profile=private,public
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 2
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -noprofile -executionpolicy bypass -command "netsh advfirewall firewall add rule name='allow internet explorer inbound' dir=in action=allow program='c:\programdata\microsoft\internet explorer\iexplore.exe' enable=yes profile=private,public"
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -noprofile -executionpolicy bypass -command "netsh advfirewall firewall add rule name='allow internet explorer outbound' dir=out action=allow program='c:\programdata\microsoft\internet explorer\iexplore.exe' enable=yes profile=private,public"
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -noprofile -executionpolicy bypass -command "netsh advfirewall firewall add rule name='allow internet explorer inbound' dir=in action=allow program='c:\programdata\microsoft\internet explorer\iexplore.exe' enable=yes profile=private,public" Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -noprofile -executionpolicy bypass -command "netsh advfirewall firewall add rule name='allow internet explorer outbound' dir=out action=allow program='c:\programdata\microsoft\internet explorer\iexplore.exe' enable=yes profile=private,public" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Queries volume information: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\misc VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation Jump to behavior
Source: C:\ProgramData\Microsoft\Bound.exe Queries volume information: C:\ProgramData\Microsoft\Bound.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\ucrtbase.dll VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\base_library.zip VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\base_library.zip VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\base_library.zip VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\base_library.zip VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\_ctypes.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\_bz2.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\base_library.zip VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\__init__.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\__init__.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\__init__.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\__init__.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\core VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\core VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\core VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\core\_multiarray_umath.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\core VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\core\_multiarray_tests.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\_socket.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\select.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\linalg VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\linalg VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\linalg VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\linalg\lapack_lite.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\linalg VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\linalg\_umath_linalg.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\fft VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\fft VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\fft VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\fft\_pocketfft_internal.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\mtrand.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\bit_generator.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_common.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\_hashlib.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_bounded_integers.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_mt19937.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_philox.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_pcg64.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_sfc64.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\numpy\random\_generator.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\load_config_py3.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\load_config_py3.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\load_config_py3.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\load_config_py3.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\config.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\config.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\config.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\config-3.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\config-3.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\config-3.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\version.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\version.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\version.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\version.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\cv2.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\data\__init__.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\data\__init__.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\data\__init__.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\data\__init__.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\misc VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\misc VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\misc VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\misc\version.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\misc\version.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\misc\version.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\misc\version.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\utils\__init__.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\utils\__init__.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\utils\__init__.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\cv2\utils\__init__.py VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\psutil VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\psutil VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\psutil VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\psutil\_psutil_windows.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\netifaces.cp37-win32.pyd VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002 VolumeInformation
Source: C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI55002\unicodedata.pyd VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Microsoft\MicrosoftEdgeUpdate.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Modifies the windows firewall
Source: C:\ProgramData\Microsoft\Bound.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "netsh advfirewall firewall delete rule name=all dir=in program='C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe'"
Uses netsh to modify the Windows network and firewall settings
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name=all dir=in "program=C:\ProgramData\Microsoft\Internet Explorer\iexplore.exe"
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.22.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.22.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.22.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.22.dr Binary or memory string: MsMpEng.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545319 Sample: SecuriteInfo.com.Win32.Drop... Startdate: 30/10/2024 Architecture: WINDOWS Score: 100 77 nt89s.kro.kr 2->77 79 nt89.kro.kr 2->79 83 Antivirus detection for dropped file 2->83 85 Antivirus / Scanner detection for submitted sample 2->85 87 Multi AV Scanner detection for dropped file 2->87 89 9 other signatures 2->89 9 SecuriteInfo.com.Win32.DropperX-gen.24481.7673.exe 8 2->9         started        signatures3 process4 file5 69 C:\ProgramData\...\MicrosoftEdgeUpdate.exe, PE32 9->69 dropped 71 C:\ProgramData\Microsoft\...\iexplore.exe, PE32 9->71 dropped 73 C:\ProgramData\Microsoft\Bound.exe, PE32 9->73 dropped 75 SecuriteInfo.com.W....24481.7673.exe.log, CSV 9->75 dropped 91 Detected unpacking (changes PE section rights) 9->91 93 Bypasses PowerShell execution policy 9->93 95 Adds a directory exclusion to Windows Defender 9->95 97 Drops executable to a common third party application directory 9->97 13 MicrosoftEdgeUpdate.exe 1 9->13         started        16 Bound.exe 3 9->16         started        18 cmd.exe 1 9->18         started        20 4 other processes 9->20 signatures6 process7 signatures8 101 Multi AV Scanner detection for dropped file 13->101 22 iexplore.exe 101 13->22         started        25 WerFault.exe 19 16 13->25         started        103 Antivirus detection for dropped file 16->103 105 Machine Learning detection for dropped file 16->105 107 Modifies the windows firewall 16->107 27 cmd.exe 16->27         started        30 powershell.exe 7 16->30         started        32 powershell.exe 16->32         started        36 2 other processes 16->36 109 Uses ping.exe to sleep 18->109 111 Uses schtasks.exe or at.exe to add and modify task schedules 18->111 113 Uses ping.exe to check the status of other devices and networks 18->113 38 2 other processes 18->38 115 Uses netsh to modify the Windows network and firewall settings 20->115 117 Loading BitLocker PowerShell Module 20->117 34 WmiPrvSE.exe 20->34         started        40 4 other processes 20->40 process9 file10 61 C:\Users\user\AppData\...\unicodedata.pyd, PE32 22->61 dropped 63 C:\Users\user\AppData\Local\...\select.pyd, PE32 22->63 dropped 65 C:\Users\user\AppData\Local\...\python37.dll, PE32 22->65 dropped 67 73 other files (30 malicious) 22->67 dropped 42 conhost.exe 22->42         started        44 iexplore.exe 22->44         started        99 Uses ping.exe to sleep 27->99 46 PING.EXE 27->46         started        49 conhost.exe 27->49         started        51 conhost.exe 30->51         started        53 netsh.exe 30->53         started        55 conhost.exe 32->55         started        57 netsh.exe 32->57         started        59 4 other processes 36->59 signatures11 process12 dnsIp13 81 127.0.0.1 unknown unknown 46->81
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
nt89.kro.kr unknown unknown
nt89s.kro.kr unknown unknown